{"id":"EUVD-2026-87902","enisaUuid":"7cf5fea1-0fef-30d5-a8a5-d19e27be5c83","description":"The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site\u0027s configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8\u0027s configuration.","datePublished":"Sep 27, 2026, 6:00:22 AM","dateUpdated":"Sep 28, 2026, 12:48:07 AM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","references":"https://wpscan.com/vulnerability/df187bfb-47f1-4259-b955-3c676f3d8cc1/\n","aliases":"CVE-2026-97227\nGHSA-j4qf-xfcc-whc6\n","assigner":"WPScan","epss":0.18,"enisaIdProduct":[{"id":"aea22597-8afd-3f58-ac56-f201c687c9b5","product":{"name":"NextScripts: Social Networks Auto-Poster","vendor":{"name":"nextscripts"}},"product_version":"0 \u003c4.4.8"}],"enisaIdVendor":[{"id":"fa61bc91-ab95-3c3e-9e45-7c25160a5f2b","vendor":{"name":"Unknown"}}],"enisaIdVulnerability":[{"id":"967c7874-a2b1-33bb-ab9f-b77d68c5776d","vulnerability":{"id":"GHSA-j4qf-xfcc-whc6","description":"The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site\u0027s configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8\u0027s configuration.","datePublished":"Sep 27, 2026, 6:30:22 AM","dateUpdated":"Sep 28, 2026, 3:30:26 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-97227\nhttps://wpscan.com/vulnerability/df187bfb-47f1-4259-b955-3c676f3d8cc1\n","enisa_id":"EUVD-2026-87902\n","aliases":"GHSA-j4qf-xfcc-whc6\nCVE-2026-97227\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:06:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b9cf1f00-1d64-3ff2-bad0-9716cb578f2f","vulnerability":{"id":"CVE-2026-97227","description":"The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site\u0027s configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8\u0027s configuration.","datePublished":"Sep 27, 2026, 6:00:22 AM","dateUpdated":"Sep 28, 2026, 12:48:07 AM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","references":"https://wpscan.com/vulnerability/df187bfb-47f1-4259-b955-3c676f3d8cc1/\n","enisa_id":"EUVD-2026-87902\n","assigner":"WPScan","epss":0.18,"dataProcessed":"Nov 5, 2026, 7:13:39 AM","vulnerabilityProduct":[{"id":"2ceb5213-921b-3372-8ecc-8b64ddf5d82c","product":{"name":"NextScripts: Social Networks Auto-Poster","vendor":{"name":"nextscripts"}},"product_version":"0 \u003c4.4.8"}],"vulnerabilityVendor":[{"id":"061341e4-a8e4-3265-b2e9-45514c1f22c4","vendor":{"name":"Unknown"}}]}}],"enisaIdAdvisory":[]}