CVE-2026-12042

Name of the Vulnerable Software and Affected Versions WP2Social Auto Publish versions prior to 2.4.13

Description Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions or higher to perform Stored Cross-Site Scripting (XSS). This occurs via the pages parameter, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where unfiltered html has been disabled.

Recommendations Update WP2Social Auto Publish to a version newer than 2.4.12.