Fs-code vulnerabilities
Published CVEs affecting Fs-code products: 3 record(s), with severity, exploitation and fixes.
Booknetic 2FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest] 1
CVE-2026-39746
Critical · 9.3
CWE-89 Oct 6, 2026
WordPress Booknetic plugin <= 4.8.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
CVE-2026-10195
High · 8.8
CWE-77 Sep 1, 2026
FS Poster <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting
The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary commands on the underlying server.
CVE-2026-25439
High · 8.1
CWE-288 Jun 17, 2026
WordPress Booknetic plugin <= 4.8.5 - Account Takeover vulnerability
Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions.