CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 30, 2026, 3:00 AM ET)

What this means for you

This week: 3,358 CVEs published, 232 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,358; Show in the list
Critical, last 7 days: 232; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,764; Show in the list

Showing CVEs that name the product pr_gateway:blog2social_social_media_auto_post_and_scheduler. Show all products

10 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2025-12563	Medium 4.3	Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload Assigned by Wordfence	Nov 5, 2025
CVE-2025-12560	Medium 4.3	Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url Assigned by Wordfence	Nov 6, 2025
CVE-2025-13558	Medium 5.4	Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing Assigned by Wordfence	Nov 24, 2025
CVE-2025-14943	Medium 4.3	Blog2Social: Social Media Auto Post & Scheduler <= 8.7.2 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure Assigned by Wordfence	Jan 10, 2026
CVE-2026-1942	Medium 6.5	Blog2Social: Social Media Auto Post & Scheduler <= 8.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification Assigned by Wordfence	Feb 18, 2026
CVE-2026-4331	Medium 4.3	Blog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action Assigned by Wordfence	Mar 25, 2026
CVE-2026-4330	Medium 4.3	Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Schedule Modification via 'b2s_id' Parameter Assigned by Wordfence	Apr 8, 2026
CVE-2026-7051	Medium 5.4	Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter Assigned by Wordfence	May 13, 2026
CVE-2026-92829	Medium 4.3	Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers Assigned by Wordfence	Sep 25, 2026
CVE-2026-108092	Medium 4.3	Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure Assigned by Wordfence	Oct 15, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.