Executive brief
The WP2Social Auto Publish plugin for WordPress allows administrator-level users to inject malicious scripts into plugin settings that execute when other users access the affected pages. This vulnerability requires administrator access and only affects multi-site WordPress installations or those with HTML filtering disabled, limiting exposure but potentially enabling account takeover or site defacement by a privileged insider.
Technical details
The plugin fails to properly sanitize and escape user input in admin settings pages, enabling authenticated attackers with administrator privileges to inject arbitrary JavaScript. The vulnerability is stored and executes in the context of other users' sessions who access the injected pages. Exploitation requires administrator-level access and is restricted to multi-site installations or configurations where unfiltered_html capability is disabled.
Affected products
- WP2Social Auto Publish up to and including 2.4.12
Timeline
- 2026-09-19: disclosed