Adenion
Monthly
Broken access control in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability (Contributor role or higher) reschedule, suppress, or otherwise alter the scheduled social-media post records belonging to other users. The issue is remotely reachable over HTTP with no user interaction, but exploitation is gated by low-privilege authentication and by the presence of other users' scheduled posts, so cross-user impact is negligible on single-author sites. It is rated CVSS 4.0 5.3 (Medium); there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available.
User email disclosure in Adenion's Blog2Social WordPress plugin before 9.1.0 allows any authenticated user holding the edit_posts capability to enumerate and retrieve the email addresses of every registered account on the site, including administrators. The b2s_search_user AJAX handler fails to restrict callers to those with the list_users capability, turning a routine user-search function into a bulk contact-harvesting primitive for low-privileged insider or subscriber-level accounts. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical risk is data-harvesting and follow-on phishing rather than code execution, so this is a genuine but modest-severity information-disclosure issue rather than a high-impact priority.
User account enumeration in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability - such as a Contributor, Author, Editor, or Administrator - resolve arbitrary numeric user IDs to their display names and confirm whether those accounts exist. The bug is an authorization bypass through a user-controlled key (CWE-639) in the b2s_get_select_mandant_user AJAX handler, which returns user data for the attacker-supplied owner parameter without checking that the caller is allowed to read account information; the CVSS 4.0 base score is 5.3 (Medium) and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only impact with no modification or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; practical risk is concentrated on sites that allow open or self-registration or that host many low-trust contributor accounts, since a valid low-privileged login is a strict prerequisite.
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up to, and including, 7.5.4 due to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the URL to make a request to is an external. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Broken access control in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability (Contributor role or higher) reschedule, suppress, or otherwise alter the scheduled social-media post records belonging to other users. The issue is remotely reachable over HTTP with no user interaction, but exploitation is gated by low-privilege authentication and by the presence of other users' scheduled posts, so cross-user impact is negligible on single-author sites. It is rated CVSS 4.0 5.3 (Medium); there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available.
User email disclosure in Adenion's Blog2Social WordPress plugin before 9.1.0 allows any authenticated user holding the edit_posts capability to enumerate and retrieve the email addresses of every registered account on the site, including administrators. The b2s_search_user AJAX handler fails to restrict callers to those with the list_users capability, turning a routine user-search function into a bulk contact-harvesting primitive for low-privileged insider or subscriber-level accounts. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical risk is data-harvesting and follow-on phishing rather than code execution, so this is a genuine but modest-severity information-disclosure issue rather than a high-impact priority.
User account enumeration in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability - such as a Contributor, Author, Editor, or Administrator - resolve arbitrary numeric user IDs to their display names and confirm whether those accounts exist. The bug is an authorization bypass through a user-controlled key (CWE-639) in the b2s_get_select_mandant_user AJAX handler, which returns user data for the attacker-supplied owner parameter without checking that the caller is allowed to read account information; the CVSS 4.0 base score is 5.3 (Medium) and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only impact with no modification or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; practical risk is concentrated on sites that allow open or self-registration or that host many low-trust contributor accounts, since a valid low-privileged login is a strict prerequisite.
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up to, and including, 7.5.4 due to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity.
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the URL to make a request to is an external. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.