NextScripts: Social Networks Auto-Poster plugin for WordPress versions up to 4.4.3 suffers from a stored cross-site scripting vulnerability due to improper neutralization of input from the HTTP_USER_AGENT header. An unauthenticated attacker can inject arbitrary JavaScript that executes when a user accesses the "All Cron Events" page. This occurs because the plugin does not sufficiently sanitize or escape this header before outputting it in the page content. The vulnerability is tracked as CVE-2024-1762 with a CVSS 3.1 score of 6.1 (medium severity). No patch or official remediation details are currently available.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary scripts in the context of the victim's browser when the victim views the "All Cron Events" page in the plugin. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of displayed content. There is no impact on availability. Exploitation requires user interaction and specific page access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid accessing the "All Cron Events" page or restrict access to trusted administrators only. Monitor for updates from NextScripts regarding a security patch.