What is the CVSS score of CVE-2026-56044?

CVE-2026-56044 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Blog2Social are affected by CVE-2026-56044?

The Blog2Social WordPress plugin (versions 8.9.2 and earlier) contains a stored/reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious code into…

How to fix or mitigate CVE-2026-56044?

Within 24 hours: Inventory all WordPress installations using Blog2Social plugin and verify versions. Within 7 days: Disable the Blog2Social plugin across all WordPress sites until a vendor patch is available; alternatively, implement web application firewall rules to block XSS payloads and enforce Content Security Policy headers on affected sites. Within 30 days: Monitor Patchstack advisories for Blog2Social patch release; evaluate alternative blog-sharing plugins; conduct forensic analysis of access logs for signs of prior exploitation; re-enable or upgrade Blog2Social only after vendor releases patched version 8.9.3 or later.

Blog2Social CVE-2026-56044

EUVD-2026-39705 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-g25w-qf74-3q97

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable XSS (AV:N/PR:N) needing victim interaction (UI:R); script runs in the browser context (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:02 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the Blog2Social WordPress plugin (versions 8.9.2 and earlier) lets unauthenticated remote attackers inject malicious JavaScript that executes in a victim's browser when they view an affected page. The CVSS 3.1 vector (AV:N/PR:N/UI:R) indicates no authentication is required but the victim must take an action such as visiting a crafted URL. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied with this report from Patchstack.

Technical ContextAI

Blog2Social is a widely used WordPress plugin that automates cross-posting and scheduling of blog content to social networks. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input reaches an HTML response context without adequate output encoding or input sanitization. Because PR:N applies, the injection point is reachable by anonymous users, and the scope change (S:C) reflects that the executed script runs in the browser security context of any user who renders the poisoned page - distinct from the vulnerable WordPress component itself. Exact affected component is identified at the product level as the Blog2Social plugin; no CPE strings were provided to pinpoint the precise file or parameter.

RemediationAI

No vendor-released patch version was identified in the provided data, so confirm the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/blog2social/vulnerability/wordpress-blog2social-plugin-8-9-2-cross-site-scripting-xss-vulnerability) and update Blog2Social to the first version above 8.9.2 once published. Until a patched build is confirmed, apply compensating controls: deploy a WAF or WordPress virtual-patch rule (Patchstack/equivalent) to filter XSS payloads against the plugin's endpoints; add a restrictive Content-Security-Policy to limit inline-script execution (note this can break legitimate inline scripts and admin UI features and requires testing); and if the plugin's social-posting features are not actively used, deactivate it entirely to remove the attack surface. Restricting access to the plugin's affected pages/parameters via server rules is an additional stopgap but may interfere with normal posting workflows.