{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3228", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-25T20:18:16.001Z", "datePublished": "2026-03-10T09:58:59.045Z", "dateUpdated": "2026-04-08T17:09:22.134Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:22.134Z"}, "affected": [{"vendor": "nextscripts", "product": "NextScripts: Social Networks Auto-Poster", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.4.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` shortcode in all versions up to, and including, 4.4.6. This is due to insufficient input sanitization and output escaping on the `snapFB` post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/923c51ba-0ec2-4e32-a86e-404f3fe2ac7c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/trunk/inc-cl/fb.php#L581"}, {"url": "https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/tags/4.4.6/inc-cl/fb.php#L581"}, {"url": "https://plugins.trac.wordpress.org/changeset/3470727/social-networks-auto-poster-facebook-twitter-g/trunk/inc-cl/fb.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2026-02-25T22:45:54.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-09T21:33:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T15:35:48.423656Z", "id": "CVE-2026-3228", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T16:51:16.054Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3228", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T15:35:48.423656Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T15:35:49.611Z"}}], "cna": {"title": "NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "nextscripts", "product": "NextScripts: Social Networks Auto-Poster", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.4.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-25T22:45:54.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-09T21:33:10.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/923c51ba-0ec2-4e32-a86e-404f3fe2ac7c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/trunk/inc-cl/fb.php#L581"}, {"url": "https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/tags/4.4.6/inc-cl/fb.php#L581"}, {"url": "https://plugins.trac.wordpress.org/changeset/3470727/social-networks-auto-poster-facebook-twitter-g/trunk/inc-cl/fb.php"}], "descriptions": [{"lang": "en", "value": "The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` shortcode in all versions up to, and including, 4.4.6. This is due to insufficient input sanitization and output escaping on the `snapFB` post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:22.134Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3228", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:09:22.134Z", "dateReserved": "2026-02-25T20:18:16.001Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-10T09:58:59.045Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` shortcode in all versions up to, and including, 4.4.6. This is due to insufficient input sanitization and output escaping on the `snapFB` post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin NextScripts: Social Networks Auto-Poster para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode `[nxs_fbembed]` en todas las versiones hasta la 4.4.6, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en el valor de metadatos de publicaci\u00f3n `snapFB`. Esto permite a atacantes autenticados, con acceso de nivel Colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-3228", "lastModified": "2026-04-22T21:27:27.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-10T18:19:00.777", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/tags/4.4.6/inc-cl/fb.php#L581"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/trunk/inc-cl/fb.php#L581"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3470727/social-networks-auto-poster-facebook-twitter-g/trunk/inc-cl/fb.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/923c51ba-0ec2-4e32-a86e-404f3fe2ac7c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.4.6]"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "NextScripts: Social Networks Auto-Poster", "source": "cna", "vendor": "nextscripts"}, "product": "social_networks_auto_poster", "vendor": "nextscripts"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T03:54:31.182627+00:00", "value": {"mitigation_remediation": ["Update the NextScripts Social Networks Auto\u2011Poster plugin to the latest available version that contains the XSS fix.", "If an immediate update is not possible, temporarily disable the `[nxs_fbembed]` shortcode by removing it from the code or configuring the plugin to ignore it, preventing future injection attempts.", "Review and restrict Contributor (or higher) user roles so they cannot edit content that uses the `[nxs_fbembed]` shortcode; consider revoking contributor privileges or forcing higher roles to use a separate administration tier."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting in a WordPress plugin that allows authenticated contributors to inject arbitrary scripts into pages"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the NextScripts Social Networks Auto\u2011Poster plugin for WordPress, all versions up to and including 4.4.6. Any WordPress site installing that plugin and providing Contributor or higher roles to users is at risk.", "description_and_impact": "A stored XSS flaw exists in the NextScripts Social Networks Auto\u2011Poster plugin through its `[nxs_fbembed]` shortcode. The plugin fails to properly sanitize or escape data stored in the `snapFB` post meta field, allowing a contributor\u2011level user to embed malicious scripts that will execute whenever a page containing the shortcode is viewed. This can lead to credential theft, defacement, session hijack, or other client\u2011side attacks against site visitors.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires only authenticated access with Contributor rights, a relatively low privilege level, and the user must manually insert the malicious shortcode. The flaw is exploit\u2011able server\u2011side, and the resulting script execution occurs client\u2011side when visitors load the infected page."}}}}, "created": "2026-03-11T11:50:22.469329+00:00", "updated": "2026-04-16T04:00:09.456976+00:00", "vendors": ["nextscripts", "nextscripts$PRODUCT$social_networks_auto_poster", "wordpress", "wordpress$PRODUCT$wordpress"]}