Medium severity4.3NVD Advisory· Published Nov 6, 2025· Updated Apr 15, 2026

CVE-2025-12560

Description

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 8.6.0 via the getFullContent() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Blog2Social/Blog2Social: Social Media Auto Post & Schedulerllm-fuzzy
Range: <=8.6.0
WordPress/Blog2socialwp-canonicalize
Package: https://wordpress.org/plugins/blog2social

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3389636/blog2socialnvd
www.wordfence.com/threat-intel/vulnerabilities/id/2ea06520-d7a9-49bb-812e-2fa2e50d0ec2nvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000