CVE-2026-16570: NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

Q: Who is exposed to this issue?

Sites using the NextScripts Social Networks Auto-Poster WordPress plugin before version 4.4.8 are affected. Exploitation targets users who are already logged in, including WordPress administrators.

Q: What must an attacker do to exploit it?

An attacker must persuade a logged-in target to open a crafted link. The malicious query-string parameters are reflected on an affected plugin admin page, causing attacker-supplied script to run in the target's browser.

Q: Is this exploitable without user interaction?

The available information describes a reflected XSS attack that requires a logged-in user to be tricked into opening a crafted link. It does not indicate that the issue can be exploited without that interaction.

Published Aug 19, 2026

Updated

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.

Affected Software

1 affected component

NextScripts Social Networks Auto-Poster WordPress plugin<4.4.8

Event History

Aug 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using the NextScripts Social Networks Auto-Poster WordPress plugin before version 4.4.8 are affected. Exploitation targets users who are already logged in, including WordPress administrators.

What must an attacker do to exploit it?

An attacker must persuade a logged-in target to open a crafted link. The malicious query-string parameters are reflected on an affected plugin admin page, causing attacker-supplied script to run in the target's browser.

Is this exploitable without user interaction?

The available information describes a reflected XSS attack that requires a logged-in user to be tricked into opening a crafted link. It does not indicate that the issue can be exploited without that interaction.