🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program

Through December 9th, 2024, all in-scope vulnerability types for WordPress plugins/themes with >= 1,000 Active Installations are in-scope for ALL researchers, all plugins and themes that are hosted in the WordPress.org repository with at least 50 active installs that have been updated in the last 2 years will be in-scope for ALL researchers, the minimum bounty awarded for all in-scope submissions will be $5, and ALL researchers earn automatic bonuses of 5%-180% for valid submissions in software with 1,000 - 4,999,999 active installs, pending report limits are increased for all, and it's possible to earn up to $31,200 for high impact vulnerabilities!

Review what's in scope for your tier and updated bounties with bonuses here!

Blog2Social: Social Media Auto Post & Scheduler

Wordfence Intelligence > Vulnerability Database > WordPress Plugins > Blog2Social: Social Media Auto Post & Scheduler

Information

Software Type	Plugin
Software Slug	blog2social (view on wordpress.org)
Software Status	Active
Software Author	pr-gateway
Software Website	www.blog2social.com
Software Downloads	3,899,365
Software Active Installs	60,000
Software Record Last Updated	November 21, 2024

14 Vulnerabilities

Submit a Vulnerability

Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload

6.4

CVE-2024-7302

Jul 31, 2024

Researcher: wesley (wcraft)

Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection

9.9

CVE-2024-3549

Jun 10, 2024

Researcher: 1337_Wannabe

Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure

5.3

CVE-2024-3678

Apr 25, 2024

Researcher: Krzysztof Zając

Blog2Social: Social Media Auto Post & Scheduler <= 7.2.0 - Reflected Cross-Site Scripting

6.1

CVE-2023-3936

Jul 26, 2023

Researcher: Erwan LR

Blog2Social <= 6.9.9 - Authenticated (Subscriber+) Server-Side Request Forgery

6.8

CVE-2022-3247

Oct 3, 2022

Researcher: Saggre

Blog2Social <= 6.9.9 - Authenticated (Subscriber+) SQL Injection

8.8

CVE-2022-3246

Oct 3, 2022

Researcher: Saggre

Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update

4.1

CVE-2022-3622

Sep 27, 2022

Researcher: Marco Wotschka

Blog2Social <= 6.9.3 - PHP Object Injection

8.5

CVE ID Unknown

Apr 5, 2022

Researchers:

Blog2Social <= 6.8.6 - Reflected Cross-Site Scripting

6.1

CVE-2021-24956

Nov 22, 2021

Researcher: ZhongFu Su

Blog2Social: Social Media Auto Post & Scheduler <= 6.3.0 - Authenticated SQL Injection

8.8

CVE-2021-24137

May 29, 2020

Researcher: Nguyen Anh Tien

Blog2Social: Social Media Auto Post & Scheduler < 5.9.0 - Reflected Cross-Site Scripting via b2s_id Parameter

6.1

CVE-2019-17550

Nov 14, 2019

Researchers:

Blog2Social: Social Media Auto Post & Scheduler <= 5.5.0 - SQL Injection

9.8

CVE-2019-13572

Jul 25, 2019

Researcher: Tin Duong

Blog2Social: Social Media Auto Post & Scheduler <= 5.0.2 - Reflected Cross-Site Scripting

6.1

CVE-2019-9576

May 2, 2019

Researcher: Tim Coen

Blog2Social: Social Media Auto Post & Scheduler < 5.0.1 - PHP Object Injection

7.4

CVE ID Unknown

Sep 21, 2018

Researcher: Plugin Vulnerabilities

Title	Status	CVE ID	CVSS	Researchers	Date
Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload	Patched	CVE-2024-7302	6.4	wesley (wcraft)	July 31, 2024
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection	Patched	CVE-2024-3549	9.9	1337_Wannabe	June 10, 2024
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure	Patched	CVE-2024-3678	5.3	Krzysztof Zając	April 25, 2024
Blog2Social: Social Media Auto Post & Scheduler <= 7.2.0 - Reflected Cross-Site Scripting	Patched	CVE-2023-3936	6.1	Erwan LR	July 26, 2023
Blog2Social <= 6.9.9 - Authenticated (Subscriber+) Server-Side Request Forgery	Patched	CVE-2022-3247	6.8	Saggre	October 3, 2022
Blog2Social <= 6.9.9 - Authenticated (Subscriber+) SQL Injection	Patched	CVE-2022-3246	8.8	Saggre	October 3, 2022
Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Update	Patched	CVE-2022-3622	4.1	Marco Wotschka	September 27, 2022
Blog2Social <= 6.9.3 - PHP Object Injection	Patched		8.5		April 5, 2022
Blog2Social <= 6.8.6 - Reflected Cross-Site Scripting	Patched	CVE-2021-24956	6.1	ZhongFu Su	November 22, 2021
Blog2Social: Social Media Auto Post & Scheduler <= 6.3.0 - Authenticated SQL Injection	Patched	CVE-2021-24137	8.8	Nguyen Anh Tien	May 29, 2020
Blog2Social: Social Media Auto Post & Scheduler < 5.9.0 - Reflected Cross-Site Scripting via b2s_id Parameter	Patched	CVE-2019-17550	6.1		November 14, 2019
Blog2Social: Social Media Auto Post & Scheduler <= 5.5.0 - SQL Injection	Patched	CVE-2019-13572	9.8	Tin Duong	July 25, 2019
Blog2Social: Social Media Auto Post & Scheduler <= 5.0.2 - Reflected Cross-Site Scripting	Patched	CVE-2019-9576	6.1	Tim Coen	May 2, 2019
Blog2Social: Social Media Auto Post & Scheduler < 5.0.1 - PHP Object Injection	Patched		7.4	Plugin Vulnerabilities	September 21, 2018

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation