What is the CVSS score of CVE-2026-65544?

CVE-2026-65544 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Super Socializer are affected by CVE-2026-65544?

The Super Socializer WordPress plugin version 7.14.5 and earlier contains an unauthenticated cross-site scripting vulnerability that allows remote attackers to inject malicious code into pages viewed…

How to fix or mitigate CVE-2026-65544?

Within 24 hours, audit all WordPress installations for Super Socializer plugin version 7.14.5 or earlier and immediately deactivate or remove the plugin from all production environments. Within 7 days, implement a restrictive Content Security Policy (CSP) header with strict script-src directives to prevent inline script injection, deploy Web Application Firewall rules to detect and block XSS payloads, and monitor the plugin vendor's security advisories for patch availability. Within 30 days, evaluate and deploy an alternative maintained plugin providing equivalent social integration functionality to replace Super Socializer.

Super Socializer CVE-2026-65544

EUVD-2026-53974 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-x3gx-2fx2-5hqr

WordPress XSS Super Socializer Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-accessible unauthenticated XSS with scope change; A:N assigned as XSS does not directly impact server availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:32 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

AnalysisAI

Unauthenticated XSS in the Super Socializer WordPress plugin (versions 7.14.5 and earlier) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users without any prior authentication. The scope change (S:C in the CVSS vector) confirms the payload executes outside the plugin's own origin, enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement lower the bar for opportunistic exploitation.

Technical ContextAI

Super Socializer is a WordPress plugin developed by Rajat Varlani (CPE: cpe:2.3:a:rajat_varlani:super_socializer:*:*:*:*:*:*:*:*) that provides social login, social sharing, and social commenting functionality. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is reflected or stored in page output without adequate sanitization or encoding before being interpreted by the browser. The plugin's social interaction surfaces - such as sharing widgets, login forms, or comment integrations - are the likely injection vectors. Malicious script delivered through these surfaces executes in the victim's browser context with access to cookies, local storage, and DOM, potentially spanning across same-origin page interactions.

RemediationAI

The primary remediation is to update the Super Socializer plugin to a version beyond 7.14.5 via the WordPress plugin dashboard or by downloading the latest release from the WordPress plugin repository. The exact patched version number is not independently confirmed from the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/super-socializer/vulnerability/wordpress-super-socializer-plugin-7-14-5-cross-site-scripting-xss-vulnerability for the confirmed fix version before updating. If an immediate update is not possible, disabling the Super Socializer plugin entirely eliminates the attack surface with the trade-off of losing social login and sharing functionality. Additionally, deploying a web application firewall (WAF) rule to detect and block XSS payloads in parameters handled by the plugin can serve as a temporary compensating control, though this does not address the root input sanitization defect.