Blog2Social: Social Media Auto Post & Scheduler

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Blog2Social: Social Media Auto Post & Scheduler

Information

Software Type Plugin
Software Slug blog2social (view on wordpress.org)
Software Status Active
Software Author pr-gateway
Software Website www.blog2social.com
Software Downloads 4,993,075
Software Active Installs 50,000
Software Record Last Updated July 11, 2026

Showing 1-20 of 25 Vulnerabilities

Submit a Vulnerability
Blog2Social: Social Media Auto Post & Scheduler <= 8.9.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-56044
Jun 25, 2026
Researcher: João Pedro S Alcântara (Kinorth)
Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter
5.4
CVE-2026-7051
May 12, 2026
Researcher: awhacken
Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter
4.3
CVE-2026-4330
Apr 7, 2026
Researcher: s00me00ne
Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action
4.3
CVE-2026-4331
Mar 25, 2026
Researcher: s00me00ne
Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
6.5
CVE-2026-1942
Feb 17, 2026
Researcher: Lucas Montes (NiRoX)
Blog2Social: Social Media Auto Post & Scheduler <= 8.7.2 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
4.3
CVE-2025-14943
Jan 9, 2026
Researcher: theviper17y
Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing
5.4
CVE-2025-13558
Nov 24, 2025
Researcher: Dmitrii Ignatyev
Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url
4.3
CVE-2025-12560
Nov 5, 2025
Researcher: LionTree
Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload
4.3
CVE-2025-12563
Nov 5, 2025
Researcher: thinnawarth mathuros
Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter
6.5
CVE-2025-5673
Jun 16, 2025
Researcher: mikemyers
Blog2Social: Social Media Auto Post & Scheduler <= 8.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-4133
May 1, 2025
Researcher: Krugov Artyom
Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
6.4
CVE-2024-7302
Jul 31, 2024
Researcher: wesley (wcraft)
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection
9.9
CVE-2024-3549
Jun 10, 2024
Researcher: 1337_Wannabe
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure
5.3
CVE-2024-3678
Apr 25, 2024
Researcher: Krzysztof Zając
Blog2Social: Social Media Auto Post & Scheduler <= 7.2.0 - Reflected Cross-Site Scripting
6.1
CVE-2023-3936
Jul 26, 2023
Researcher: Erwan LR
Blog2Social <= 6.9.9 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2022-3246
Oct 3, 2022
Researcher: Saggre
Blog2Social <= 6.9.9 - Authenticated (Subscriber+) Server-Side Request Forgery
6.8
CVE-2022-3247
Oct 3, 2022
Researcher: Saggre
Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update
4.1
CVE-2022-3622
Sep 27, 2022
Researcher: Marco Wotschka
Blog2Social <= 6.9.3 - PHP Object Injection
8.5
CVE ID Unknown
Apr 5, 2022
Researchers:
Blog2Social <= 6.8.6 - Reflected Cross-Site Scripting
6.1
CVE-2021-24956
Nov 22, 2021
Researcher: ZhongFu Su
Title Status CVE ID CVSS Researchers Date
Blog2Social: Social Media Auto Post & Scheduler <= 8.9.2 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-56044 7.2 João Pedro S Alcântara (Kinorth) June 25, 2026
Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter Patched CVE-2026-7051 5.4 awhacken May 12, 2026
Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter Patched CVE-2026-4330 4.3 s00me00ne April 7, 2026
Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action Patched CVE-2026-4331 4.3 s00me00ne March 25, 2026
Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification Patched CVE-2026-1942 6.5 Lucas Montes (NiRoX) February 17, 2026
Blog2Social: Social Media Auto Post & Scheduler <= 8.7.2 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure Patched CVE-2025-14943 4.3 theviper17y January 9, 2026
Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing Patched CVE-2025-13558 5.4 Dmitrii Ignatyev November 24, 2025
Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url Patched CVE-2025-12560 4.3 LionTree November 5, 2025
Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload Patched CVE-2025-12563 4.3 thinnawarth mathuros November 5, 2025
Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter Patched CVE-2025-5673 6.5 mikemyers June 16, 2025
Blog2Social: Social Media Auto Post & Scheduler <= 8.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-4133 6.4 Krugov Artyom May 1, 2025
Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload Patched CVE-2024-7302 6.4 wesley (wcraft) July 31, 2024
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection Patched CVE-2024-3549 9.9 1337_Wannabe June 10, 2024
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure Patched CVE-2024-3678 5.3 Krzysztof Zając April 25, 2024
Blog2Social: Social Media Auto Post & Scheduler <= 7.2.0 - Reflected Cross-Site Scripting Patched CVE-2023-3936 6.1 Erwan LR July 26, 2023
Blog2Social <= 6.9.9 - Authenticated (Subscriber+) SQL Injection Patched CVE-2022-3246 8.8 Saggre October 3, 2022
Blog2Social <= 6.9.9 - Authenticated (Subscriber+) Server-Side Request Forgery Patched CVE-2022-3247 6.8 Saggre October 3, 2022
Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update Patched CVE-2022-3622 4.1 Marco Wotschka September 27, 2022
Blog2Social <= 6.9.3 - PHP Object Injection Patched 8.5 April 5, 2022
Blog2Social <= 6.8.6 - Reflected Cross-Site Scripting Patched CVE-2021-24956 6.1 ZhongFu Su November 22, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation