CVE-2023-3936

MEDIUMNuclei

Blog2Social < 7.2.1 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-3936 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Blog2Social: Social Media Auto Post & Scheduler

Default status: unaffected

CVE List7.1.0 to < 7.2.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMBlog2Social < 7.2.1 - Cross-Site ScriptingCVSS 6.1

The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the Blog2Social plugin (7.2.1) or apply the vendor-provided patch to mitigate this vulnerability.

WeaknessesCWE-79
Authorsluisfelipe146
Template tagscve2023cvewpscanwordpresswp-pluginxssauthenticatedadenionvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:adenion:blog2social:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/6d09a5d3-046d-47ef-86b4-c024ea09dc0f https://nvd.nist.gov/vuln/detail/CVE-2023-3936

Source: ProjectDiscovery

References

2