CVE-2026-12042 is a stored cross-site scripting vulnerability (CWE-79) in the WP2Social Auto Publish plugin for WordPress. It arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated administrators to inject arbitrary web scripts. The vulnerability affects all versions from 0 through 2.4.12 inclusive and is limited to multi-site installations or installations with unfiltered_html disabled. The CVSS 3.1 base score is 4.4 (medium severity), with network attack vector, high attack complexity, high privileges required, no user interaction, and a scope change. The impact includes limited confidentiality and integrity loss but no availability impact.

An attacker with administrator-level privileges can inject persistent malicious scripts into pages via the plugin's admin settings. These scripts execute in the context of users who visit the affected pages, potentially leading to unauthorized actions or data exposure within the WordPress environment. The vulnerability is limited to multi-site setups or where unfiltered_html is disabled, reducing the attack surface. There are no known exploits in the wild at this time.

No official patch or fix has been published yet for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the WP2Social Auto Publish plugin in multi-site environments or where unfiltered_html is disabled to mitigate risk.