CVE-2021-24975— NextScripts: Social Networks Auto-Poster < 4.3.24 - Unauthenticated Stored XSS
Quick assessment
Affected
Unknown NextScripts: Social Networks Auto-Poster
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress是Wordpress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是WordPress开源的一个应用插件。 NextScripts: Social Networks Auto-Poster WordPress plugin 4.3.24之前版本存在跨站脚本漏洞，该漏洞源于在将日志请求输出到相关管理仪表板之前没有进行转义，导致未经身份验证的存储跨站点脚本问题。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24975
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NextScripts: Social Networks Auto-Poster < 4.3.24 - Unauthenticated Stored XSS
Source: CVE Program / CVE List V5
Vulnerability Description
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress是Wordpress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是WordPress开源的一个应用插件。 NextScripts: Social Networks Auto-Poster WordPress plugin 4.3.24之前版本存在跨站脚本漏洞，该漏洞源于在将日志请求输出到相关管理仪表板之前没有进行转义，导致未经身份验证的存储跨站点脚本问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | NextScripts: Social Networks Auto-Poster | 4.3.24 ~ 4.3.24 | - |
|
II. Public POCs for CVE-2021-24975
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24975
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-24975 (1)
-
https://plugins.trac.wordpress.org/changeset/2650138 x_refsource_CONFIRM
Vendor Advisories for CVE-2021-24975 (1)
Same Patch Batch · Unknown · 2022-02-01 · 18 CVEs total
| CVE-2021-25063 | Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS) | |
| CVE-2022-0320 | Essential Addons for Elementor < 5.0.5 - Unauthenticated LFI | |
| CVE-2022-0220 | WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site Scripting | |
| CVE-2021-25093 | Link Library < 7.2.8 - Unauthenticated Arbitrary Links Deletion | |
| CVE-2021-25092 | Link Library < 7.2.8 - Library Settings Reset via CSRF | |
| CVE-2021-25091 | Link Library < 7.2.9 - Reflected Cross-Site Scripting | |
| CVE-2021-25089 | UpdraftPlus < 1.16.69 - Reflected Cross-Site Scripting | |
| CVE-2021-25085 | WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site Scripting | |
| CVE-2021-25072 | NextScripts: Social Networks Auto-Poster < 4.3.25 - Arbitrary Post Deletion via CSRF | |
| CVE-2021-25097 | LabTools <= 1.0 - Subscriber+ Arbitrary Publication Deletion | |
| CVE-2021-24983 | Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting via AJAX Action | |
| CVE-2021-24944 | Custom Dashboard & Login Page < 7.0 - Admin+ Stored Cross-Site Scripting | |
| CVE-2021-24937 | Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting | |
| CVE-2021-24934 | Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting | |
| CVE-2021-24900 | Ninja Tables < 4.1.8 - Admin+ Stored Cross-Site Cross-Site Scripting | |
| CVE-2021-24762 | Perfect Survey < 1.5.2 - Unauthenticated SQL Injection | |
| CVE-2021-24761 | Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF |
IV. Related Vulnerabilities
Same product: NextScripts: Social Networks Auto-Poster
-
CVE-2026-97227
NextScripts: Social Networks Auto-Poster < 4.4.8 - Authentic -
CVE-2026-16570
NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected -
CVE-2026-3228
NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenti -
CVE-2020-36831
NextScripts: Social Networks Auto-Poster <= 4.3.17 - Missing -
CVE-2024-1762
NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthen
Same vendor: Unknown
-
CVE-2026-94238
Loco Translate < 2.8.9 - Translator+ Limited File Read via ' -
CVE-2026-94239
Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle C -
CVE-2026-92923
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscrib -
CVE-2026-96962
Pie Register < 3.8.4.14 - Unauthenticated User Email Disclos -
CVE-2026-89236
SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sor
Same weakness: CWE-79
-
CVE-2026-103342
WordPress Unlimited Elements For Elementor (Free Widgets, Ad -
CVE-2026-105116
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie -
CVE-2026-105114
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization -
CVE-2026-92767
Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contri -
CVE-2026-104313
WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Refle
V. Comments for CVE-2021-24975
No comments yet