WordPress Auto Post Scheduler Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Auto Post Scheduler plugin for WordPress, affecting all versions up to and including 1.84. The vulnerability arises from a lack of nonce validation in the 'aps_options_page' function, allowing unauthenticated attackers to manipulate settings and inject malicious scripts. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability could lead to Cross-Site Scripting (XSS) attacks, where injected scripts are executed in the context of the user.