ThemeRuby vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ThemeRuby products: 4 record(s), with severity, exploitation and fixes.

Easy Post Submission 2 ThemeRuby Multi Authors – Assign Multiple Writers to Posts 1 Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress 1

Exploited only (KEV) →

CVE-2026-4431 Critical · 9.1 CWE-862 Aug 5, 2026

Easy Post Submission <= 2.3.0 - Missing Authorization

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. This is due to the `rbsm_submit_post` AJAX action being registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without any authorization checks when a `postId` parameter is supplied. This makes it possible for unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, as well as change the post status to draft (effectively unpublishing them) via the 'postId' parameter.

CVE-2026-22479 High · 7.5 CWE-862 Mar 5, 2026

WordPress Easy Post Submission plugin <= 2.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Post Submission: from n/a through <= 2.4.0.

CVE-2026-1097 Medium · 6.4 CWE-79 Jan 24, 2026

ThemeRuby Multi Authors <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

The ThemeRuby Multi Authors – Assign Multiple Writers to Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' shortcode attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-62062 Medium · 5.5 CWE-201 Oct 22, 2025

WordPress Easy Post Submission plugin <= 1.7.0 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Retrieve Embedded Sensitive Data.This issue affects Easy Post Submission: from n/a through <= 1.7.0.