Description

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-31T21:17:53.717Z",
  "pubdate": "2026-08-31T21:17:53.717Z",
  "executiveSummary": "The WordPress Social Login and Register plugin, in versions 7.8.2 and below, contains a critical security vulnerability involving Unauthenticated Reflected Cross-Site Scripting (XSS).\nThis vulnerability allows unauthenticated, remote attackers to inject malicious JavaScript into the web pages viewed by other users, including site administrators.\nThe flaw exists because the plugin fails to properly sanitize or validate user-supplied input before reflecting it back in the browser response.\nSuccessful exploitation can result in the compromise of user sessions, redirection to malicious websites, unauthorized execution of administrative actions, or the theft of sensitive browser-stored information such as session cookies or CSRF tokens.\nDue to the lack of authentication requirements, the attack vector is available to any remote user with network access to the target WordPress instance, posing a significant risk to the integrity and confidentiality of the affected platform.\nAdministrators are advised to restrict the exposure of the plugin or update to a patched version if available to mitigate the risk of cross-site scripting attacks.",
  "technicalDetails": "The vulnerability is classified as an Unauthenticated Reflected Cross-Site Scripting (XSS) flaw within the WordPress Social Login and Register plugin. The root cause lies in the improper handling of HTTP GET or POST parameters that are processed by the plugin and subsequently reflected in the application's output without adequate output encoding or context-aware sanitization.\nThe vulnerable component performs dynamic content rendering based on user-controllable input. In the affected versions (<= 7.8.2), the plugin fails to utilize WordPress security APIs, such as esc_html() or esc_attr(), on the data received during the request process. Consequently, an attacker can supply a specially crafted string containing JavaScript payloads—such as <script>alert(document.cookie)</script>—within the vulnerable parameter.\nThe attack flow follows a predictable sequence: First, the attacker identifies a URL or form parameter processed by the plugin that is reflected in the server response. Second, the attacker crafts a malicious URL containing a JavaScript payload encoded within this parameter. Third, the attacker lures an authenticated user, typically an administrator, to click the malicious link or visit the crafted page. Fourth, the victim's browser executes the injected script within the security context of the vulnerable WordPress site.\nBecause the payload executes in the victim's browser, the attacker can leverage the victim's session privileges. If the victim is an administrator, the attacker could theoretically perform arbitrary actions, such as creating new administrative accounts, modifying plugin settings, or injecting persistent malicious content into the database, effectively leading to a full site takeover.\nThe exploitation does not require prior authentication, making it a high-risk vector for external attackers. The vulnerability is triggered entirely on the client-side of the affected web application, reflecting the payload back to the end-user. The impact is compounded by the lack of defensive headers or Content Security Policy (CSP) that might otherwise constrain the execution of unauthorized inline scripts in less hardened environments. The exploitation is trivial to execute once the vulnerable parameter is identified, as it does not require complex memory corruption techniques or bypasses of modern binary protections."
}