CVE-2026-1097 is a stored cross-site scripting vulnerability in the ThemeRuby Multi Authors – Assign Multiple Writers to Posts WordPress plugin (versions up to 1.0.0). The issue stems from improper neutralization of input in the 'before' and 'after' shortcode attributes, enabling authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts are stored and executed when other users access the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network exploitable, low attack complexity, requiring privileges, no user interaction, with partial impact on confidentiality and integrity but no impact on availability. No patch or vendor advisory is currently provided.

An authenticated attacker with Contributor-level or higher access can inject persistent malicious scripts via shortcode attributes. These scripts execute in the context of users visiting the affected pages, potentially leading to partial confidentiality and integrity compromise. There is no impact on system availability. The vulnerability could be leveraged to perform actions such as session hijacking or unauthorized actions within the affected WordPress site context.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's channels for updates or advisories. Until a fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.