Wp2Social Auto Publish
Monthly
Stored cross-site scripting in the WP2Social Auto Publish WordPress plugin (published in the repository as facebook-auto-publish) affects all versions up to and including 2.4.12, allowing an administrator-level user to persist arbitrary JavaScript into plugin admin settings so that it executes in the browser of anyone who later views the injected page. The flaw carries a CVSS v3.1 base score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) because it is gated behind high privilege and a non-default deployment posture: it only matters on WordPress multisite installations or on single-site installs where the unfiltered_html capability has been explicitly removed, since a normal single-site administrator already holds unfiltered_html and could inject markup legitimately. No public exploit code and no confirmed active exploitation were identified at time of analysis; this is a genuine but low-priority issue given the required administrative access and the non-default preconditions.
Stored cross-site scripting in the WP2Social Auto Publish WordPress plugin (published in the repository as facebook-auto-publish) affects all versions up to and including 2.4.12, allowing an administrator-level user to persist arbitrary JavaScript into plugin admin settings so that it executes in the browser of anyone who later views the injected page. The flaw carries a CVSS v3.1 base score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) because it is gated behind high privilege and a non-default deployment posture: it only matters on WordPress multisite installations or on single-site installs where the unfiltered_html capability has been explicitly removed, since a normal single-site administrator already holds unfiltered_html and could inject markup legitimately. No public exploit code and no confirmed active exploitation were identified at time of analysis; this is a genuine but low-priority issue given the required administrative access and the non-default preconditions.