CVE-2025-12064

MediumCVSS 6.1

Published: 08/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage up to version 2.4.7. This is due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.

Risk Assessment

The risk involves the possibility of an unauthenticated attacker injecting malicious scripts, which could lead to data theft or session hijacking. The attack requires user interaction, such as clicking a crafted link.

Recommendation

It is recommended to update the plugin to the latest patched version. Also, educate users not to click on suspicious links.

Other vulnerabilities in WP2Social Auto Publish

CVE-2026-12042Medium
The WP2Social Auto Publish plugin for WordPress (versions up to and including 2.4.12) is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Original NVD description (English source)

The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS