What’s Vulnerable › Products
pr-gateway Blog2Social: Social Media Auto Post & Scheduler vulnerabilities
29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your pr-gateway Blog2Social: Social Media Auto Post & Scheduler version is affected
Latest pr-gateway Blog2Social: Social Media Auto Post & Scheduler vulnerabilities
- CVE-2026-108092 — Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 4.3)
- CVE-2026-92829 — Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers (CVSS 4.3)
- CVE-2026-89031 — Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post (CVSS 5.4)
- CVE-2026-89030 — Blog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_user (CVSS 4.3)
- CVE-2026-89029 — Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler (CVSS 4.3)
- CVE-2026-56044 — WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-7051 — Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter (CVSS 5.4)
- CVE-2026-4330 — Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter (CVSS 4.3)
- CVE-2026-4331 — Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action (CVSS 4.3)
- CVE-2026-1942 — Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification (CVSS 6.5)
- CVE-2025-14943 — Blog2Social: Social Media Auto Post & Scheduler <= 8.7.2 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3)
- CVE-2025-13558 — Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing (CVSS 5.4)
- CVE-2025-12560 — Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url (CVSS 4.3)
- CVE-2025-12563 — Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload (CVSS 4.3)
- CVE-2025-5673 — Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter (CVSS 6.5)
- CVE-2025-4133 — Blog2Social: Social Media Auto Post & Scheduler < 8.4.0 - Contributor+ Stored XSS (CVSS 5.4)
- CVE-2024-7302 — Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload (CVSS 5.4)
- CVE-2024-3549 — Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection (CVSS 9.9)
- CVE-2024-3678 — Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure (CVSS 5.3)
- CVE-2022-3622 — Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.1)
- CVE-2023-40554 — WordPress Blog2Social Plugin <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
- CVE-2023-3936 — Blog2Social < 7.2.1 - Reflected XSS (CVSS 6.1)
- CVE-2022-3247 — Blog2Social < 6.9.10 - Subscriber+ SSRF (CVSS 6.5)
- CVE-2022-3246 — Blog2Social < 6.9.10 - Subscriber+ SQLi (CVSS 8.8)
- CVE-2021-24956 — Blog2Social < 6.8.7 - Reflected Cross-Site Scripting (CVSS 6.1)