miniOrange Social Login CVE-2026-73351

The target WordPress installation must have the miniOrange Social Login and Register plugin installed and active at version 7.8.1 or earlier. The CVSS vector PR:N confirms no attacker authentication is required against the WordPress site. Exploitation requires active user interaction (UI:R): the victim must click or navigate to an attacker-crafted URL - autonomous, scannable exploitation is not possible. Maximum impact is realized when the victim holds an authenticated WordPress administrator session at the time of clicking, because the injected script inherits the victim's full session privileges. No special server configuration, non-default WordPress settings, or specific social provider integration is indicated as a prerequisite beyond the plugin being active. The key limiting factor for mass exploitation is the mandatory phishing or social engineering step required to deliver the crafted URL to a privileged victim.

The CVSS 3.1 score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a genuinely exploitable unauthenticated reflected XSS requiring no privileges and only low attack complexity. The sole limiting factor in the vector is UI:R - a victim must follow a crafted link - but this is trivially achieved via phishing, malicious redirects, or comment-section links. No EPSS data was supplied, so exploitation probability cannot be quantified beyond the CVSS vector. The absence of a CISA KEV listing and confirmed public POC suggests no mass exploitation is underway at time of analysis, though Patchstack disclosures consistently attract rapid weaponization in the WordPress threat landscape. The S:C designation elevates realistic risk substantially: JavaScript executing in an authenticated administrator's browser session can install plugins, create rogue admin accounts, or exfiltrate credentials, effectively converting a moderate-CVSS XSS into a full site takeover primitive. The A:L (availability impact low) in the vendor-provided CVSS vector is atypical for reflected XSS and is flagged as uncertain - it may reflect the potential for forced redirects or session termination, but is not confirmed by the available description.

An attacker identifies a WordPress site running the miniOrange Social Login plugin at version 7.8.1 or earlier and crafts a URL that embeds a JavaScript payload in a plugin-processed parameter such as an OAuth error message or redirect field. The attacker delivers this URL to a WordPress administrator via a targeted phishing email. When the administrator opens the link while logged into the WordPress backend, the unencoded payload executes in their browser session, allowing the attacker to exfiltrate the session cookie, create a new administrator account, or install a malicious plugin - achieving full site compromise without ever authenticating. No confirmed public POC exists at time of analysis, though the attack pattern is well-understood for reflected XSS in WordPress plugin OAuth handlers.