XSS Vulnerability in NextScripts: Social Networks Auto-Poster Plugin Impacts 100,000 Sites

WordFence - 

Note: To receive disclosures like this in your inbox the moment they’re published, you can subscribe to our WordPress Security Mailing List.

On August 19, 2021, the Wordfence Threat Intelligence team began the disclosure process for a reflected Cross-Site Scripting(XSS) vulnerability we found in NextScripts: Social Networks Auto-Poster, a WordPress plugin with over 100,000 installations.

The plugin’s developer responded, so we confidentially provided the full disclosure the next day, on August 20, 2021. After several weeks without updates, we followed up with the developer on September 27, 2021, and a patched version of the plugin, 4.3.21, was released on October 4, 2021.

All Wordfence users, including Wordfence Premium customers as well as those still using the free version of Wordfence, are protected against this vulnerability by our firewall’s built-in cross-site scripting protection.

Description: Reflected Cross-Site Scripting(XSS)
Affected Plugin: NextScripts: Social Networks Auto-Poster
Plugin Slug: social-networks-auto-poster-facebook-twitter-g
Affected Versions: <= 4.3.20
CVE ID: CVE-2021-38356
CVSS Score: 6.1(Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Researcher/s: Ramuel Gall
Fully Patched Version: 4.3.21

The nxs_ReposterListTable::column_title function in inc/nxs_class_snap.php echoed out the value of $_REQUEST[‘page’] when an administrator was visiting the plugin administration page at wp-admin/admin.php?admin.php?page=nxssnap-post.

function column_post_title($item){ //Build row actions $actions = array( ‘edit’ => sprintf(‘<a

Read More: https://www.wordfence.com/blog/2021/10/xss-vulnerability-in-nextscripts-social-networks-auto-poster-plugin-impacts-100000-sites/