CVE-2026-12042

Received Received - Intake

Stored XSS in WP2Social Auto Publish WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-12042

Affected Vendors & Products

Vendor	Product	Version / Range
wp2social	auto_publish	to 2.4.12 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The WP2Social Auto Publish WordPress plugin has a stored cross-site scripting (XSS) vulnerability in versions up to 2.4.12. It occurs due to insufficient input sanitization and output escaping in admin settings. Authenticated attackers with administrator-level access can inject malicious scripts into pages. These scripts execute when users access the affected pages. The vulnerability only impacts multi-site installations or sites where unfiltered_html has been disabled.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into your WordPress site. If exploited, these scripts can steal user data, hijack sessions, or deface your website. Since it requires administrator access, the risk is limited to sites with compromised admin accounts or where unfiltered_html is disabled.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR or HIPAA requirements for protecting user data. If exploited, it could result in unauthorized access to sensitive information, potentially leading to regulatory fines or legal consequences.

Mitigation Strategies

Update the WP2Social Auto Publish plugin to the latest version beyond 2.4.12. If you cannot update, disable the plugin immediately. Ensure input sanitization is enabled and unfiltered_html is restricted for non-trusted users.

Hi! I’m here to help you understand CVE-2026-12042. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70