Threat database

The Easy Post Submission plugin for WordPress up to version 2.3.0 has a critical vulnerability due to missing authorization checks in its AJAX handler. This flaw allows unauthenticated attackers to modify arbitrary posts, including changing titles, content, categories, tags, and unpublishing posts by setting their status to draft. The vulnerability arises because the AJAX action 'rbsm_submit_post' is accessible without authentication and lacks capability checks when a 'postId' parameter is provided.

Missing Authorization vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Post Submission: from n/a through <= 2.4.0.

The ThemeRuby Multi Authors – Assign Multiple Writers to Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' shortcode attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Insertion of Sensitive Information Into Sent Data vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Retrieve Embedded Sensitive Data.This issue affects Easy Post Submission: from n/a through <= 1.7.0.