What is the CVSS score of CVE-2026-65561?

CVE-2026-65561 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

WordPress Social Login CVE-2026-65561

Q: Which versions of WordPress Social Login are affected by CVE-2026-65561?

Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts.

EUVD-2026-49234 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-27 Patchstack

GHSA-hf2j-gvjf-q7gw

XSS WordPress Wordpress Social Login And Register

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Requires low-privileged contributor account and user interaction, so PR:L and UI:R; scope change due to XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:R/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 15:06 vuln.today

CVE Published

Jul 27, 2026 - 13:59 cve.org

MEDIUM 6.5

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

AnalysisAI

Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.

Technical ContextAI

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in a WordPress plugin that provides social login and registration functionality. The plugin likely fails to properly sanitize user-supplied input (e.g., profile fields from social login providers) before outputting it in pages accessible to administrators. The CPE string indicates all versions up to 7.8.0 are affected. The root cause is insufficient output encoding in the plugin's code, allowing attacker-controlled data to be interpreted as HTML/JavaScript in the victim's browser.

RemediationAI

Upgrade to the latest patched version of the plugin (7.8.1 or later) as released by miniOrange. The official advisory is available at https://patchstack.com/database/wordpress/plugin/miniorange-login-openid/vulnerability/wordpress-wordpress-social-login-and-register-plugin-7-8-0-cross-site-scripting-xss-vulnerability. As a workaround, limit contributor-level user accounts and enforce content review by administrators before viewing untrusted content. Disable the social login feature if not essential, though this may break functionality.