WordPress Social Login CVE-2026-65561

The attacker must have a WordPress account with at least Contributor-level privileges (PR:L). The victim must be an administrator or other user who views the page containing the injected payload (UI:R). The attack requires the social login plugin to be active and configured to display user-provided data on admin pages. No special network access is needed; the attack is remote and low complexity.

CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-based exploitation requiring contributor privileges and user interaction. No CISA KEV entry, no EPSS score, and no public POC are available in the provided data. The SSVC decision framework would rate exploitation status as 'none' given no evidence of active exploits, and technical impact is low across all CIA metrics. This is a moderate-priority issue: patching should be scheduled during regular maintenance, but no emergency action is warranted.

A contributor with a valid account crafts a malicious JavaScript payload in a social profile field (e.g., display name). When an administrator visits the plugin's settings or user profile page, the payload executes, stealing the admin's session cookie. The attacker then uses the stolen cookie to impersonate the admin and perform sensitive actions.