WordPress Social Login EUVD-2026-68798

The target WordPress site must have the miniOrange Social Login and Register plugin installed, activated, and accessible at version 7.8.2 or earlier. The attacker requires no authentication or privileges (PR:N per CVSS vector). Exploitation requires the victim to click or load a crafted URL (UI:R), meaning a social engineering or phishing step is a hard prerequisite-automated mass scanning cannot exploit this without victim interaction. Sites that have deactivated the plugin, restricted its login endpoints via network controls, or are running a patched version are not affected. No special server-side configuration beyond plugin activation is required.

The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-exploitable, low-complexity attack requiring no attacker authentication but depending on victim interaction-consistent with reflected or DOM-based XSS. The scope-changed vector elevates the score by acknowledging cross-browser-context impact. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified from available intelligence. The vulnerability is absent from CISA's KEV catalog and no public exploit code is identified, reducing immediate urgency relative to a KEV-listed issue. However, the unauthenticated, low-complexity nature, combined with the broad WordPress plugin ecosystem deployment, makes opportunistic exploitation plausible if the attack vector becomes publicly enumerable. The A:L availability metric in the reported vector is atypical for XSS and may reflect aggressive scoring; independent assessment sets it to A:N. Real-world risk is moderate: administrator session hijacking and site defacement are realistic outcomes, but the UI:R requirement precludes mass automated exploitation.

An attacker crafts a URL targeting the miniOrange Social Login plugin's OAuth callback or redirect parameter, embedding a JavaScript payload in an unsanitized field. The attacker delivers this link to a site administrator via phishing email or social engineering. When the administrator clicks the link and the page renders in their browser, the injected script executes in their authenticated session context, exfiltrating their session cookie or performing administrative actions on the attacker's behalf.