Reflected XSS in NextScripts: Social Networks Auto-Poster < 4.4.8 via CVE-2026-16570

Vulnerability Overview Vulnerability Name: NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback Vulnerability Type: Reflected Cross-Site Scripting (Reflected XSS) Vulnerability Description: The plugin fails to properly escape certain query string parameters, allowing attackers to execute reflected cross-site scripting attacks on the admin pages, thereby posing a threat to logged-in users such as administrators. CVE Number: CVE-2026-16570 Classification: - Type: XSS - OWASP Top 10: A7: Cross-Site Scripting (XSS) - CWE: CWE-79 - CVSS Score: 7.1 (High) Affected Range Affected Plugin: NextScripts: Social Networks Auto-Poster Affected Versions: < 4.4.8 Remediation Fixed Version: 4.4.8 Fix Status: Fixed Timeline Public Disclosure Date: 2026-08-17 Added Date: 2026-08-17 Last Updated: 2026-08-17 Additional Information Original Researcher: Dmitrii Ignatyev Submitter: Dmitrii Ignatyev Submitter Website: https://research.cleantalk.org/ Verification Status: Verified WPVDB ID: 25c42ca3-ff25-4b43-a712-2876398d82ab References CVE: CVE-2026-16570 Other Related Vulnerabilities Blaze - Unspecified XSS (2014-08-01) Otter Blocks < 2.6.5 - Contributor+ Stored Cross-Site Scripting (2024-03-13) Waitlist Woocommerce WP Calendar <= 1.5.3 - Contributor+ Stored XSS (2022-12-07) Jeeng Push Notifications < 2.0.4 - Admin+ Stored Cross-Site Scripting (2022-11-02) POC Code Summary This vulnerability is a Reflected Cross-Site Scripting (Reflected XSS) affecting early versions (< 4.4.8) of the NextScripts: Social Networks Auto-Poster plugin. Attackers can execute reflected XSS attacks on administrator pages by constructing malicious links. The remediation is to upgrade to version 4.4.8 or later.

Goal Reached Thanks to every supporter — we hit 100%!

Reflected XSS in NextScripts: Social Networks Auto-Poster < 4.4.8 via CVE-2026-16570

More from this source