CVE-2026-12042: WP2Social Auto Publish XSS Vulnerability

CVE-2026-12042 Overview

CVE-2026-12042 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WP2Social Auto Publish plugin for WordPress. The flaw affects all versions up to and including 2.4.12 and stems from insufficient input sanitization and output escaping in the plugin's admin settings. Authenticated attackers with administrator-level permissions or above can inject arbitrary web scripts that execute when users access affected pages. Exploitation is restricted to WordPress multi-site installations and installations where the unfiltered_html capability has been disabled.

Critical Impact
An authenticated administrator on a multi-site WordPress installation can inject persistent JavaScript into admin settings, executing in the browsers of other users who visit the injected pages.

Affected Products

WP2Social Auto Publish plugin for WordPress (also distributed as facebook-auto-publish)
All versions up to and including 2.4.12
Multi-site WordPress installations and installations where unfiltered_html is disabled

Discovery Timeline

2026-09-19 - CVE-2026-12042 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-12042

Vulnerability Analysis

The WP2Social Auto Publish plugin exposes admin settings that accept user-controlled input without adequate sanitization or output escaping. When an attacker with administrator privileges submits crafted content through the settings interface, the plugin stores the payload and later renders it into administrative pages without proper encoding. The result is persistent script execution in the browser of any user who views the affected page.

Because the payload is stored server-side, exploitation is reliable and repeatable. In multi-site WordPress deployments, standard site administrators do not hold the unfiltered_html capability by default, which is why the issue is scoped to multi-site or single-site installations where that capability has been explicitly removed.

Root Cause

The root cause is a missing sanitization and escaping layer around admin settings handled in admin/settings.php and the AJAX handlers in admin/ajax-actions.php. Input reaches storage without being filtered through WordPress functions such as sanitize_text_field(), and output is rendered without esc_attr() or esc_html(). See the vendor references for the specific lines: ajax-actions.php L39, ajax-actions.php L46, and settings.php L534.

Attack Vector

The attack is network-based and requires high privileges plus a scope change, which aligns with the multi-site restriction. An authenticated administrator submits a settings value containing JavaScript through the plugin's admin form or AJAX endpoint. The payload persists in plugin options and executes whenever any user with access renders the affected settings page. In a multi-site context, this allows a lower-tier site administrator to affect network administrators who visit the injected page. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for technical details.

Detection Methods for CVE-2026-12042

Indicators of Compromise

Unexpected <script>, onerror, or onload strings stored in WordPress wp_options rows belonging to the facebook-auto-publish or wp2social plugin.
Administrator sessions triggering outbound requests to unfamiliar domains immediately after loading the plugin's settings page.
Unauthorized creation or modification of administrator accounts following a visit to the plugin settings by a network administrator.

Detection Strategies

Review plugin option values via wp option get for HTML or JavaScript content in fields that should hold plain text or URLs.
Inspect web server access logs for POST requests to admin-ajax.php referencing plugin actions from admin/ajax-actions.php.
Monitor browser Content Security Policy (CSP) violation reports on /wp-admin/ pages for inline script executions originating from plugin settings.

Monitoring Recommendations

Alert on changes to WordPress wp_options entries associated with the plugin, especially outside scheduled maintenance windows.
Track administrator logins to multi-site network dashboards and correlate with subsequent plugin setting modifications.
Enable audit logging plugins to record admin-level configuration changes with the acting user and source IP.

How to Mitigate CVE-2026-12042

Immediate Actions Required

Update the WP2Social Auto Publish plugin to a version later than 2.4.12 once released, or deactivate the plugin on multi-site networks until a patch is available.
Audit administrator accounts on all sites within multi-site networks and remove unnecessary privileges.
Review the plugin's stored settings for any injected script content and remove malicious payloads.

Patch Information

At the time of publication, versions up to and including 2.4.12 are affected. Review the WordPress Plugin Changeset and the Wordfence Vulnerability Report for the latest fix status and upgrade guidance.

Workarounds

Restrict site administrator accounts on multi-site installations to trusted personnel only, since exploitation requires administrator privileges.
Deploy a Web Application Firewall (WAF) rule that blocks script tags and event handler attributes in POST bodies targeting the plugin's AJAX endpoints.
Enforce a strict Content Security Policy on /wp-admin/ that disallows inline scripts, reducing the impact of stored XSS payloads.
Consider replacing the plugin with an actively maintained alternative if patched releases are not published in a timely manner.

bash

# Example: disable the plugin network-wide using WP-CLI
wp plugin deactivate facebook-auto-publish --network

# Inspect stored plugin options for script content
wp option list --search='*wp2social*' --format=table
wp option list --search='*facebook_auto*' --format=table