The NextScripts: Social Networks Auto-Poster WordPress plugin prior to version 4.4.8 does not escape some query-string parameters it reflects on an admin page. This flaw enables reflected Cross-Site Scripting (CWE-79) attacks, where an attacker can trick logged-in users into opening crafted URLs that execute arbitrary scripts in their browsers. The vulnerability affects versions from 0 up to but not including 4.4.8. It has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows attackers to execute arbitrary scripts in the context of authenticated users, potentially leading to session hijacking, privilege escalation, or other malicious actions within the WordPress admin interface. The impact includes partial loss of confidentiality, integrity, and availability as indicated by the CVSS vector.

A fix is available in NextScripts: Social Networks Auto-Poster version 4.4.8. Users should upgrade to version 4.4.8 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.