WP Social Login CVE-2026-97344

Requires an authenticated account with subscriber-level access or above (PR:L) - practically meaning the target site must permit user registration or the attacker must otherwise obtain a low-privilege account. Exploitation specifically depends on invoking the nonce-only dismiss_ajax_call endpoint (whose nonce is accessible to subscribers from any wp-admin page) to set the xs_social_profile_image user-meta flag, which activates the unescaped img output branch in xs_social_get_avatar; the payload is then delivered via the account display name, which core's ENT_NOQUOTES handling leaves unescaped. The plugin (Wp Social Login and Register Social Counter ≤3.2.1) must be installed and active. Impact is realized only when another user - ideally a privileged one - views a page rendering the malicious avatar, so a victim must browse to the affected page for the stored script to fire.

This is a moderate-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) that sits well below the top-priority tier despite being network-reachable. The CVSS vector confirms low attack complexity and that only subscriber-level (PR:L) authentication is required, with a scope change (S:C) reflecting that the injected script executes in other users' browser sessions - including potentially administrators. No EPSS score, KEV listing, or public POC was supplied in the intelligence, so exploitation status is 'no public exploit identified at time of analysis'; the finding comes from Wordfence/Wordfence Threat Intel research rather than observed in-the-wild activity. The notable real-world friction is the two-step chaining requirement: an attacker must first abuse the nonce-only dismiss_ajax_call endpoint to set the xs_social_profile_image meta flag, then plant a script payload in their display name. This is a legitimate but conditional self-registered-user attack rather than a wormable, unauthenticated internet-wide threat, so prioritize patching on sites that permit open subscriber registration, but it does not warrant emergency out-of-band response. No signals conflict; the main gap is the absence of EPSS/KEV/POC data to gauge likelihood of weaponization.

On a WordPress site allowing open user registration, an attacker registers a subscriber account, loads any wp-admin page to obtain the accessible nonce, and invokes the dismiss_ajax_call endpoint to set the xs_social_profile_image meta flag on their own account, activating the unescaped avatar img output branch. They then change their display name to a JavaScript payload, which executes in the browser of any user (e.g. an administrator) who views a page rendering that avatar. No public exploit code is identified at time of analysis, but the chain is fully described in the vendor advisory.