Stored Cross-Site Scripting in WP2Social Auto Publish Plugin for WordPress

CVE-2026-12042

What is CVE-2026-12042?

The WP2Social Auto Publish plugin for WordPress is affected by a vulnerability that allows stored cross-site scripting due to inadequate input sanitization and output escaping. This issue impacts all versions up to and including 2.4.12, enabling authenticated attackers with necessary permissions to inject malicious scripts through the admin settings interface. These scripts execute when users access affected pages. The vulnerability is particularly relevant in multi-site installations and environments with unfiltered_html disabled.

References