CVE-2026-3228

The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` shortcode in all versions up to, and including, 4.4.6. This is due to insufficient input sanitization and output escaping on the `snapFB` post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/tags/4.4.6/inc-cl/fb.php#L581
• https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/trunk/inc-cl/fb.php#L581
• https://plugins.trac.wordpress.org/changeset/3470727/social-networks-auto-poster-facebook-twitter-g/trunk/inc-cl/fb.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/923c51ba-0ec2-4e32-a86e-404f3fe2ac7c?source=cve

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32274Black is the uncompromising Python code formatter. Starting …7.5
• CVE-2026-32275Tautulli is a Python based monitoring and tracking tool for …9.1
• CVE-2026-32276Connect-CMS is a content management system. In versions on t…8.8
• CVE-2026-32277Connect-CMS is a content management system. In versions 1.35…8.7
• CVE-2026-32278Connect-CMS is a content management system. In versions on t…4.8
• CVE-2026-32279Connect-CMS is a content management system. In versions on t…6.8
• CVE-2026-32280During chain building, the amount of work that is done is no…7.5
• CVE-2026-32281Validating certificate chains which use policies is unexpect…7.5
• CVE-2026-32282On Linux, if the target of Root.Chmod is replaced with a sym…6.4
• CVE-2026-32283If one side of the TLS connection sends multiple key update …7.5
• CVE-2026-32284The msgpack decoder fails to properly validate the input buf…7.5
• CVE-2026-32285The Delete function fails to properly validate offsets when …7.5