Super Socializer
Monthly
Unauthenticated XSS in the Super Socializer WordPress plugin (versions 7.14.5 and earlier) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users without any prior authentication. The scope change (S:C in the CVSS vector) confirms the payload executes outside the plugin's own origin, enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement lower the bar for opportunistic exploitation.
Super Socializer plugin for WordPress (versions ≤ 7.14.5) contains a broken authentication vulnerability (CWE-288) that permits unauthenticated remote attackers to bypass the social login authentication mechanism and gain unauthorized access to WordPress user accounts. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low-complexity network exploitation requiring victim interaction, consistent with a social login callback or token-verification bypass where a victim must initiate or interact with the login flow. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high CVSS score (8.8) and full C/I/A impact reflect the potential for complete account takeover.
The Social Share, Social Login and Social Comments Plugin - Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Missing Authorization vulnerability in Rajat Varlani Super Socializer super-socializer allows Exploiting Incorrectly Configured Access Control Security Levels.13.54. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Social Share, Social Login and Social Comments Plugin - Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated XSS in the Super Socializer WordPress plugin (versions 7.14.5 and earlier) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users without any prior authentication. The scope change (S:C in the CVSS vector) confirms the payload executes outside the plugin's own origin, enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement lower the bar for opportunistic exploitation.
Super Socializer plugin for WordPress (versions ≤ 7.14.5) contains a broken authentication vulnerability (CWE-288) that permits unauthenticated remote attackers to bypass the social login authentication mechanism and gain unauthorized access to WordPress user accounts. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates low-complexity network exploitation requiring victim interaction, consistent with a social login callback or token-verification bypass where a victim must initiate or interact with the login flow. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the high CVSS score (8.8) and full C/I/A impact reflect the potential for complete account takeover.
The Social Share, Social Login and Social Comments Plugin - Super Socializer plugin for WordPress is vulnerable to Limited SQL Injection via the ‘SuperSocializerKey’ parameter in all versions up to,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Missing Authorization vulnerability in Rajat Varlani Super Socializer super-socializer allows Exploiting Incorrectly Configured Access Control Security Levels.13.54. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Social Share, Social Login and Social Comments Plugin - Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.