The WP2Social Auto Publish plugin for WordPress contains a reflected cross‑site scripting vulnerability that is triggered through PostMessage when inputs are not properly sanitized or escaped. An unauthenticated attacker can inject arbitrary JavaScript that will run in the victim’s browser when a user clicks a malicious link, potentially allowing credential theft, site defacement, or session hijacking.

All versions of the WP2Social Auto Publish plugin up to 2.4.7, distributed by f1logic, are affected. This includes every WordPress site that has installed these plugin versions.

The CVSS score of 6.1 denotes moderate severity, and the EPSS score is under 1 %, indicating a low probability of exploitation in the wild. The vulnerability does not require elevated privileges and depends on user interaction, so attackers rely on social engineering or malicious links. Although it is not listed in the CISA KEV catalog, site owners should treat the flaw as a legitimate threat because of its ability to compromise all users who visit a crafted URL.