The Blog2Social plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via 3gp2 file uploads. Authenticated attackers with author-level access or higher can inject arbitrary web scripts due to improper input neutralization and output escaping. These scripts execute when users access the uploaded 3gp2 files, potentially compromising user sessions or data. The vulnerability affects all versions up to 7.5.4. The CVSS score of 6.4 reflects a medium risk with network attack vector, low attack complexity, and privileges required at the author level. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation allows an authenticated user with author-level privileges or higher to inject malicious scripts that execute in the context of other users accessing the 3gp2 files. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of other users. Availability is not affected. The vulnerability requires authentication and is exploitable over the network with low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and consider disabling or limiting 3gp2 file uploads if possible. Monitor for plugin updates from the vendor and apply them promptly once available.