CVE-2026-89029 Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...

CVE-2026-89029

Adenion Blog2Social is a WordPress plugin that, in versions before 9.1.0 , exposes a user enumeration flaw. The b2s_get_select_mandant_user AJAX handler (in includes/Ajax/Get.php) resolves arbitrary user IDs supplied via the owner parameter to display names without verifying the caller's authoriz...

CVE-2026-89029 Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

CVE-2026-89030: Missing Authorization

Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2ssearchuser AJAX handler in includes/Ajax/Get.php invokes B2STools::searchUser in includes/Tools.php, which returns the email address of every...

CVE-2026-89029: Authorization Bypass Through User-Controlled Key

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2sgetselectmandantuser AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller ...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Authenticated (Subscriber+) Username Enumeration vulnerability

Authenticated Subscriber+ Username Enumeration vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

CVE-2026-89031: Authorization Bypass Through User-Controlled Key

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2scalendarmovepost AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2sposts table using only the attacker-supplied b2sid primary key with...

CVE-2026-56044

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

CVE-2026-56044 WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

CVE-2026-56044

The CVE-2026-56044 entry concerns the WordPress Blog2Social plugin (versions up to and including 8.9.2) and describes an Unauthenticated Cross-Site Scripting (XSS) vulnerability in that plugin. The report identifies the affected product as the Blog2Social WordPress plugin and states the vulnerabi...

EUVD-2026-39705

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

CVE-2026-56044 WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

PT-2026-52758

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

CVE-2026-56044: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Blog2Social versions = 8.9.2...

CVE-2026-7051

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2SPostTools::deleteUserPublishPost and B2SPostTools::deleteUserSchedPost functions,...

CVE-2026-4330

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2sid' parameter belongs to...

CVE-2026-7051

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2SPostTools::deleteUserPublishPost and B2SPostTools::deleteUserSchedPost functions,...