WordPress Plugin Vulnerabilities

Blog2Social <= 5.0.2 - Authenticated Cross-Site Scripting (XSS)

Description

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) security vulnerability.

Proof of Concept

Affects Plugins

Plugin icon
blog2social
Fixed in 5.0.3

References

CVE
CVE-2019-9576
URL
https://lists.openwall.net/full-disclosure/2019/02/05/6
URL
https://security-consulting.icu/blog/2019/02/wordpress-blog2social-xss/
URL
https://plugins.trac.wordpress.org/changeset/1963393/blog2social

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Submitter
Ryan Dewhurst
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
e5bcd333-3b62-4fbd-a45e-bb9e515ac880

Timeline

Publicly Published
2019-02-05 (about 7 years ago)
Added
2019-03-06 (about 7 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2015-08-25
Title
Anti-Spam by CleanTalk < 5.22 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Published
2025-11-22
Title
Better Search < 4.2.2 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2023-10-16
Title
Tiny Carousel Horizontal Slider <= 8.1 - Admin+ Stored XSS
Published
2024-08-12
Title
WP Bannerize Pro < 1.9.1 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2024-07-17
Title
Smart Post Show <= 3.0.0 - Editor+ Stored XSS