CVE-2026-12042: WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter
The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfilteredhtml has been disabled.
Affected Software
Event History
Frequently Asked Questions
Which WordPress deployments are affected?
The issue affects WP2Social Auto Publish versions through 2.4.12 only on WordPress multisite installations or installations where the unfiltered_html capability has been disabled. Other installations are not identified as affected by the provided information.
What access does an attacker need?
An attacker must already be authenticated with administrator-level permissions or higher. Exploitation also requires the attacker to submit malicious script content through the plugin's pages setting parameter.
What is the impact after successful exploitation?
The injected script is stored in the affected admin settings and executes when a user accesses an injected page. This can expose or alter content available in that user's browser session.