HomeWordPress vulnerabilitiesBlog2Social
Blog2Social vulnerabilities
Blog2Social has 26 known vulnerabilities in this database. The most recent published record is dated 25 Sep 2026.
- Known vulnerabilities
- 26
- Active installs
- 50,000+
- Latest version
- 9.1.3
- Last updated
- 29 Sep 2026
- Most recent
- 25 Sep 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Broken access control CVE-2026-92829 | Medium 4.3 | Up to 9.1.0 | Fixed in a later version (latest 9.1.3) | 12 d ago |
| Broken access control CVE-2026-89031 | Medium 5.3 | Before 9.1.0 | Fixed in 9.1.0 | 16 Sep 2026 |
| Broken access control CVE-2026-89030 | Medium 5.3 | Before 9.1.0 | Fixed in 9.1.0 | 16 Sep 2026 |
| Broken access control CVE-2026-89029 | Medium 5.3 | Before 9.1.0 | Fixed in 9.1.0 | 16 Sep 2026 |
| Broken access control CVE-2026-7051 | Medium 5.4 | Up to 8.9.0 | Fixed in a later version (latest 9.1.3) | 13 May 2026 |
| Broken access control CVE-2026-4330 | Medium 4.3 | Up to 8.8.3 | Fixed in a later version (latest 9.1.3) | 8 Apr 2026 |
| Broken access control CVE-2026-4331 | Medium 4.3 | Up to 8.8.2 | Fixed in a later version (latest 9.1.3) | 26 Mar 2026 |
| Broken access control CVE-2026-1942 | Medium 6.5 | Up to 8.7.4 | Fixed in a later version (latest 9.1.3) | 18 Feb 2026 |
| Sensitive data exposure CVE-2025-14943 | Medium 4.3 | Up to 8.7.2 | Fixed in a later version (latest 9.1.3) | 10 Jan 2026 |
| Broken access control CVE-2025-13558 | Medium 5.4 | Up to 8.7.0 | Fixed in a later version (latest 9.1.3) | 25 Nov 2025 |
| Server-side request forgery (SSRF) CVE-2025-12560 | Medium 4.3 | Up to 8.6.0 | Fixed in a later version (latest 9.1.3) | 6 Nov 2025 |
| Broken access control CVE-2025-12563 | Medium 4.3 | Up to 8.6.0 | Fixed in a later version (latest 9.1.3) | 6 Nov 2025 |
| SQL injection CVE-2025-5673 | Medium 6.5 | Up to 8.4.4 | Fixed in a later version (latest 9.1.3) | 17 Jun 2025 |
| Cross-site scripting (XSS) CVE-2025-4133 | Medium 5.4 | Before 8.4.0 | Fixed in 8.4.0 | 22 May 2025 |
| Cross-site scripting (XSS) CVE-2024-7302 | Medium 6.4 | Before 7.5.5 | Fixed in 7.5.5 | 1 Aug 2024 |
| SQL injection CVE-2024-3549 | Critical 9.9 | Before 7.4.2 | Fixed in 7.4.2 | 11 Jun 2024 |
| Sensitive data exposure CVE-2024-3678 | Medium 5.3 | Before 7.5.0 | Fixed in 7.5.0 | 26 Apr 2024 |
| Broken access control CVE-2022-3622 | Medium 4.1 | Up to 6.9.11 | Fixed in a later version (latest 9.1.3) | 20 Oct 2023 |
| Cross-site scripting (XSS) CVE-2023-3936 | Medium 6.1 | Before 7.2.1 | Fixed in 7.2.1 | 21 Aug 2023 |
| SQL injection CVE-2022-3246 | High 8.8 | Before 6.9.10 | Fixed in 6.9.10 | 25 Oct 2022 |
| Server-side request forgery (SSRF) CVE-2022-3247 | Medium 6.5 | Before 6.9.10 | Fixed in 6.9.10 | 25 Oct 2022 |
| Cross-site scripting (XSS) CVE-2021-24956 | Medium 6.1 | Before 6.8.7 | Fixed in 6.8.7 | 21 Dec 2021 |
| SQL injection CVE-2021-24137 | High 8.8 | Before 6.3.1 | Fixed in 6.3.1 | 18 Mar 2021 |
| Cross-site scripting (XSS) CVE-2019-17550 | Medium 6.1 | Before 5.9.0 | Fixed in 5.9.0 | 13 Nov 2019 |
| SQL injection CVE-2019-13572 | Critical 9.8 | Up to 5.5.0 | Fixed in a later version (latest 9.1.3) | 1 Aug 2019 |
| Cross-site scripting (XSS) CVE-2019-9576 | Medium 6.1 | Before 5.0.3 | Fixed in 5.0.3 | 5 Mar 2019 |
Read the published descriptions
- CVE-2026-92829, 25 Sep 2026
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view, modify, or delete other users' Blog2Social records, including disclosing another user's network authentication IDs and scheduled post content, overwriting Open Graph and Twitter Card post metadata on posts they do not own, rebinding another user's social-network authorization, and mass-hiding all users' scheduled posts sitewide. The plugin's b2s_security_nonce is emitted on the post-edit meta box, which Contributors can render, making the nonce available to any authenticated user at that role level or above. CVE record
- CVE-2026-89031, 16 Sep 2026
- Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the attacker-supplied b2s_id primary key with no blog_user_id ownership constraint, allowing any user with the edit_posts capability to reschedule, suppress, or alter the publication state of any other user's scheduled social media post. CVE record
- CVE-2026-89030, 16 Sep 2026
- Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php invokes B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators. CVE record
- CVE-2026-89029, 16 Sep 2026
- Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs. CVE record
- CVE-2026-7051, 13 May 2026
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2S_Post_Tools::deleteUserPublishPost() and B2S_Post_Tools::deleteUserSchedPost() functions, neither function includes a blog_user_id constraint in its database query, allowing authenticated attackers to soft-delete any user's B2S post records by supplying arbitrary sequential wp_b2s_posts.id values via the 'postId' parameter. This makes it possible for authenticated attackers to delete other users' published and scheduled social media post records, disrupting content publishing workflows. CVE record
- CVE-2026-4330, 8 Apr 2026
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users' scheduled social media posts. CVE record
- CVE-2026-4331, 26 Mar 2026
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags() function only verifying that the user has the 'read' capability and a valid b2s_security_nonce, both of which are available to Subscriber-level users, as the plugin grants 'blog2social_access' capability to all roles upon activation, allowing them to access the plugin's admin pages where the nonce is output. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all _b2s_post_meta records from the wp_postmeta table, permanently removing all custom social media meta tags for every post on the site. CVE record
- CVE-2026-1942, 18 Feb 2026
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b2s_curation_draft AJAX action in all versions up to, and including, 8.7.4. The curationDraft() function only verifies current_user_can('read') without checking whether the user has edit_post permission for the target post. Combined with the plugin granting UI access and nonce exposure to all roles, this makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the title and content of arbitrary posts and pages by supplying a target post ID via the 'b2s-draft-id' parameter. CVE record
- CVE-2025-14943, 10 Jan 2026
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. This is due to a misconfigured authorization check on the 'getShipItemFullText' function which only verifies that a user has the 'read' capability (Subscriber-level) and a valid nonce, but fails to verify whether the user has permission to access the specific post being requested. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract data from password-protected, private, or draft posts. CVE record
- CVE-2025-13558, 25 Nov 2025
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteUserCcDraftPost' function in all versions up to, and including, 8.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the status of arbitrary posts to trash. CVE record
- CVE-2025-12560, 6 Nov 2025
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 8.6.0 via the getFullContent() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. CVE record
- CVE-2025-12563, 6 Nov 2025
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on theuploadVideo() function in all versions up to, and including, 8.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload mp4 files to the 'wp-content/uploads/<YYYY>/<MM>/' directory. CVE record
- CVE-2025-5673, 17 Jun 2025
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the ‘prgSortPostType’ parameter in all versions up to, and including, 8.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2025-4133, 22 May 2025
- The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks. CVE record
- CVE-2024-7302, 1 Aug 2024
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 3gp2 file uploads in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the 3gp2 file. CVE record
- CVE-2024-3549, 11 Jun 2024
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-3678, 26 Apr 2024
- The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. This makes it possible for unauthenticated attackers to view limited information from password protected posts. CVE record
- CVE-2022-3622, 20 Oct 2023
- The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change some plugin settings intended to be modifiable by admins only. CVE record
- CVE-2023-3936, 21 Aug 2023
- The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin CVE record
- CVE-2022-3246, 25 Oct 2022
- The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers CVE record
- CVE-2022-3247, 25 Oct 2022
- The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the URL to make a request to is an external one. As a result, any authenticated users, such as subscriber could perform SSRF attacks CVE record
- CVE-2021-24956, 21 Dec 2021
- The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue CVE record
- CVE-2021-24137, 18 Mar 2021
- Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands. CVE record
- CVE-2019-17550, 13 Nov 2019
- The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2s_id parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL. CVE record
- CVE-2019-13572, 1 Aug 2019
- The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. CVE record
- CVE-2019-9576, 5 Mar 2019
- The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. CVE record
What to do if you run Blog2Social
If you run Blog2Social, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Blog2Social vulnerabilities
Free. We email you when a new vulnerability is published for Blog2Social, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.