CVE-2026-16570

Deferred Deferred - Pending Action

Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-26

Assigner: WPScan

Description

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-16570

EUVD

EUVD-2026-62270

Affected Vendors & Products

Vendor	Product	Version / Range
nextscripts	social_networks_auto_poster	to 4.4.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the NextScripts: Social Networks Auto-Poster WordPress plugin before version 4.4.8. It occurs because some query-string parameters are not properly escaped when reflected back on an admin page. Attackers can exploit this by sending a crafted link to a logged-in user, such as an administrator, who then executes arbitrary scripts in their session.

Detection Guidance

Check the installed version of the NextScripts: Social Networks Auto-Poster plugin. If it is below 4.4.8, the system is vulnerable. Look for unusual admin page interactions or unexpected script executions in browser logs.

Impact Analysis

If you are an administrator or logged-in user of a WordPress site using the vulnerable plugin, clicking a malicious link could allow an attacker to execute arbitrary scripts in your browser session. This could lead to session hijacking, unauthorized actions on your site, or theft of sensitive data like cookies or credentials.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR or HIPAA. For example, GDPR requires protecting personal data, and a breach could result in fines or legal consequences. HIPAA mandates safeguarding protected health information, which could be compromised through such attacks.

Mitigation Strategies

Update the NextScripts: Social Networks Auto-Poster plugin to version 4.4.8 or later immediately. Avoid clicking on suspicious links sent by untrusted sources until the update is applied.

Hi! I’m here to help you understand CVE-2026-16570. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70