CVE-2021-24137: Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-89

Description

Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands.

Affected products

pr-gateway Blog2Social: Social Media Auto Post & Scheduler: before 6.3.1 — fixed in 6.3.1

How to fix

Upgrade to a fixed version: pr-gateway Blog2Social: Social Media Auto Post & Scheduler 6.3.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/9eb94e55-765b-4df5-baea-b247ef72aef3
https://wpscan.com/vulnerability/9eb94e55-765b-4df5-baea-b247ef72aef3

Get alerted when CVE-2021-24137 or the next vulnerability affects your stack