The WordPress plugin ThemeRuby Multi Authors – Assign Multiple Writers to Posts is vulnerable to stored cross‑site scripting because the plugin does not sanitize or escape input in the 'before' and 'after' shortcode attributes. Users with Contributor level or higher can inject arbitrary JavaScript that will be executed whenever a page containing the shortcode is viewed, allowing an attacker to hijack sessions, deface pages or deliver phishing attacks through manipulated content.

All versions of the plugin up to and including 1.0.0 installed on a WordPress site are affected. The flaw requires an authenticated user with Contributor‑or‑higher privileges who can edit or create posts containing this shortcode.

The flaw carries a CVSS score of 6.4, indicating moderate severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. Attackers would need legitimate Contributor access and would typically use the shortcode editor to inject malicious code, which would then run in the browsers of any visitor to the affected page.