NextScripts: Social Networks Auto-Poster < 4.4.8 – Reflected XSS via Facebook OAuth Callback | CVE 2026-16570

Description

The plugin does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.

Proof of Concept

The PoC will be displayed on September 17, 2026, to give users the time to update.

Affects Plugins

social-networks-auto-poster-facebook-twitter-g

Fixed in 4.4.8

References

CVE

CVE-2026-16570

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

7.1 (high)

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://research.cleantalk.org/

Verified

Yes

WPVDB ID

25c42ca3-ff25-4b43-a712-2876398d82ab

Timeline

Publicly Published

2026-08-17 (about 3 days ago)

Added

2026-08-17 (about 2 days ago)

Last Updated

2026-08-17 (about 2 days ago)

Other

Published

Title

Published

2023-04-28

Title

User IP and Location < 2.2.1 - Contributor+ Stored XSS

Published

2024-03-25

Title

Survey Maker < 4.0.7 - Reflected Cross-Site Scripting

Published

2021-12-16

Title

Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)

Published

2023-08-14

Title

123.chat < 1.3.1 - Admin+ Stored XSS

Published

2022-04-19

Title

th23 Social <= 1.2.0 - Admin+ Stored Cross-Site Scripting