Title: Security
Last modified: December 11, 2023

---

# Security

 *  Resolved [bclaim](https://wordpress.org/support/users/bclaim/)
 * (@bclaim)
 * [2 years, 8 months ago](https://wordpress.org/support/topic/security-123/)
 * Hi Paul,
 * Have you seen this? [https://patchstack.com/database/vulnerability/author-avatars/wordpress-author-avatars-list-block-plugin-2-1-16-cross-site-scripting-xss-vulnerability](https://patchstack.com/database/vulnerability/author-avatars/wordpress-author-avatars-list-block-plugin-2-1-16-cross-site-scripting-xss-vulnerability)
 * Wordfence is also reporting the issue.

Viewing 7 replies - 1 through 7 (of 7 total)

 *  Plugin Author [Paul Bearne](https://wordpress.org/support/users/pbearne/)
 * (@pbearne)
 * [2 years, 8 months ago](https://wordpress.org/support/topic/security-123/#post-17269538)
 * no, I haven’t been notified 
   I am trying to workout what the issue isThanks for
   letting me know
 *  [dptuck](https://wordpress.org/support/users/dptuck/)
 * (@dptuck)
 * [2 years, 8 months ago](https://wordpress.org/support/topic/security-123/#post-17271641)
 * Hi Paul,
 * WPScan also is reporting this vulnerability: [https://wpscan.com/vulnerability/039b05c7-4715-4e30-b221-9fb1b0ca01f5/](https://wpscan.com/vulnerability/039b05c7-4715-4e30-b221-9fb1b0ca01f5/)
   
   Thanks for looking into this issue. We’ve been using this plugin for a long time
   and really like it… does just what we need.
 * Denise
 *  Plugin Author [Paul Bearne](https://wordpress.org/support/users/pbearne/)
 * (@pbearne)
 * [2 years, 8 months ago](https://wordpress.org/support/topic/security-123/#post-17272202)
 * Released version 2.1.17, which fixes this 
   a couple of the the inputs from the
   code weren’t escaped
 *  [dptuck](https://wordpress.org/support/users/dptuck/)
 * (@dptuck)
 * [2 years, 8 months ago](https://wordpress.org/support/topic/security-123/#post-17272460)
 * I’ve just updated to the new version. Thank you!
 *  Plugin Author [Paul Bearne](https://wordpress.org/support/users/pbearne/)
 * (@pbearne)
 * [2 years, 8 months ago](https://wordpress.org/support/topic/security-123/#post-17275959)
 * still trying to work how to get the alert cleared
 *  Plugin Author [Paul Bearne](https://wordpress.org/support/users/pbearne/)
 * (@pbearne)
 * [2 years, 8 months ago](https://wordpress.org/support/topic/security-123/#post-17281127)
 * Fixed
 *  [dptuck](https://wordpress.org/support/users/dptuck/)
 * (@dptuck)
 * [2 years, 8 months ago](https://wordpress.org/support/topic/security-123/#post-17281206)
 * Thank you!

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Security’ is closed to new replies.

 * ![](https://ps.w.org/author-avatars/assets/icon-256x256.png?rev=973937)
 * [Author Avatars List/Block](https://wordpress.org/plugins/author-avatars/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/author-avatars/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/author-avatars/)
 * [Active Topics](https://wordpress.org/support/plugin/author-avatars/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/author-avatars/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/author-avatars/reviews/)

 * 9 replies
 * 3 participants
 * Last reply from: [dptuck](https://wordpress.org/support/users/dptuck/)
 * Last activity: [2 years, 8 months ago](https://wordpress.org/support/topic/security-123/#post-17281206)
 * Status: resolved