CVE-2026-16570

HighCVSS 7.1

Published: 19/08/2026(UTC)Updated: 22/10/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.

Risk Assessment

Reflected XSS attacks can lead to admin session hijacking and unauthorized actions performed in the context of their account.

Recommendation

Update the NextScripts plugin to version 4.4.8 or later, which includes security fixes.

Other vulnerabilities in NextScripts: Social Networks Auto-Poster

CVE-2026-97227Medium
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the plugin's configuration.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS