Medium severity4.3NVD Advisory· Published Nov 6, 2025· Updated Apr 15, 2026

CVE-2025-12563

Description

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on theuploadVideo() function in all versions up to, and including, 8.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload mp4 files to the 'wp-content/uploads///' directory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Blog2socialllm-fuzzy
Range: <=8.6.0
Package: https://wordpress.org/plugins/blog2social

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3389636/blog2socialnvd
www.wordfence.com/threat-intel/vulnerabilities/id/3710f139-0f17-426c-b48c-4c42ae4bab5fnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000