The Social Media Auto Publish plugin is vulnerable to a reflected Cross‑Site Scripting flaw that can be triggered through the PostMessage parameter. An unauthenticated attacker can craft a malicious link that, when clicked by a visitor, injects arbitrary JavaScript into the page. The injected script runs in the victim’s browser with the privileges of the website, potentially enabling session hijacking, credential theft, or defacement of site content.

This issue affects all installations of the f1logic Social Media Auto Publish plugin for WordPress up to and including version 3.6.5. Sites running the plugin within any WordPress environment are vulnerable unless upgraded beyond that version.

The vulnerability carries a CVSS base score of 6.1 and an EPSS of less than 1 %, indicating a low likelihood of exploitation, and it is not listed in the CISA KEV database. Attackers do not require authentication and can exploit the flaw simply by directing a user to a malicious URL containing the unchecked PostMessage parameter. While the chance of active exploitation is currently low, the potential impact to user sessions and data integrity is significant enough that the flaw should be remedied promptly.