rootpwn

medium · CVSS v3 4.4 · EPSS 0.00208

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) within its administrative settings. This

Overview

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) within its administrative settings. This vulnerability exists in all versions up to 2.4.12 due to inadequate input sanitization and output escaping of user-provided data.

Description

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Impact

Successful exploitation allows high-privileged users to execute arbitrary scripts in the browser sessions of other administrators. This impacts the integrity and confidentiality of the administrative interface, particularly in multi-site WordPress environments or those with restricted HTML capabilities. The risk is primarily focused on session hijacking or unauthorized configuration changes within the management console.

Remediation

Update the WP2Social Auto Publish plugin to the latest available version (greater than 2.4.12) to ensure proper sanitization routines are in place. Administrators should also review plugin settings for any unauthorized script tags and verify that the 'unfiltered_html' capability is restricted to trusted users only.

Risk context

The vulnerability is rated as Medium severity with a CVSS score of 4.4. The low EPSS score of 0.00208 suggests a low probability of current active exploitation in the wild, largely because the flaw requires administrator-level privileges to execute.

Affected products

  • WP2Social Auto Publish (WordPress Plugin)

Scores

Severity
medium
CVSS v2
3.2
CVSS v3
4.4
CVSS v4
—
EPSS
0.00208

WordPress XSS Stored XSS Plugin WP2Social Administrative

← All CVEs

Related CVEs

medium

CVE-2026-15660

The SEO Booster plugin for WordPress versions up to 7.4.7 suffers from a missing authorization check that allows any authenticated user with Subscriber role or higher to overwrite critical options. This can disrupt the Google Search Console integration and inject attacker‑supplied data into site options. The flaw is exploitable via a crafted /wp-admin/ URL that triggers the vulnerable handle_oauth_callback function.

View analysis

medium

CVE-2026-15760

The Divi Essential plugin for WordPress contains a vulnerability in its AJAX handlers that allows authenticated users to access sensitive database information. Due to missing authorization checks and bypassable security tokens, any user with Subscriber-level access can enumerate and read arbitrary database tables. This exposure includes critical data such as user credentials, session tokens, and site configuration settings.

View analysis

medium

CVE-2025-15698

The Business Name Generator plugin for WordPress, up to version 1.3, contains a vulnerability where configuration settings are not properly sanitized or escaped. This allows high-privileged users to inject malicious scripts into the application's database, which are then executed when the settings page is viewed.

View analysis

medium

CVE-2026-16557

The Nimble Page Builder plugin for WordPress contains an authorization bypass vulnerability in its AJAX handling logic. This flaw allows any authenticated user, including those with low-level Subscriber permissions, to view the content of non-public posts such as drafts, private pages, and scheduled content.

View analysis