Description

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:17:03.503Z",
  "pubdate": "2026-08-18T15:17:03.503Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the WordPress Social Login and Register plugin for versions 7.8.1 and below. This security flaw allows remote, unauthenticated threat actors to inject malicious JavaScript payloads into web pages rendered to unsuspecting users visiting the target WordPress site.\nThe primary impact of this vulnerability includes potential session hijacking, theft of sensitive authentication cookies, redirection to malicious destinations, and unauthorized actions performed within the context of the victim's browser session. The affected systems are WordPress installations utilizing the vulnerable versions of the Social Login and Register plugin.\nRisk implications are significant as the vulnerability requires no prior authentication or user privileges, lowering the barrier to exploitation. An attacker can craft a malicious URL containing the exploit payload and induce users to click it via phishing vectors or drive-by mechanisms. Successful exploitation compromises the integrity of the user interaction with the application, allowing arbitrary script execution in the Document Object Model (DOM).",
  "technicalDetails": "The vulnerability resides in the input handling mechanisms of the WordPress Social Login and Register plugin affecting versions <= 7.8.1. The root cause stems from the application failing to properly sanitize, validate, or escape user-supplied input parameters before reflecting them back into the Document Object Model (DOM) of the HTTP response.\nDue to the lack of adequate context-aware output encoding, an unauthenticated remote attacker can inject arbitrary HTML or JavaScript payloads into vulnerable HTTP request parameters processed by the plugin. When a victim visits a maliciously crafted URL or interacts with the crafted link, the unvalidated input is processed by the server and rendered directly within the browser context.\nThe attack flow proceeds as follows: First, the attacker identifies the vulnerable endpoint exposed by the WordPress Social Login and Register plugin. Second, the attacker crafts a malicious URI incorporating a malicious JavaScript payload designed to bypass weak filters or exploit direct reflection. Third, the attacker distributes this payload to targets via external communication channels. Fourth, when the victim accesses the crafted link, the server generates an HTTP response containing the unescaped payload. Finally, the victim's browser parses the response, executing the arbitrary script in the security context of the origin site.\nThe vulnerable component involves the request handling logic of the plugin where user-supplied parameters are handled without sanitization. The vulnerability is exploitable over the network without requiring any authentication or specific user privileges. The payload behavior typically involves executing arbitrary JavaScript in the victim's session, enabling actions such as DOM manipulation, session token exfiltration, or defacement."
}