Wordpress Social Login And Register
Monthly
Unauthenticated XSS in miniOrange's WordPress Social Login and Register plugin (versions 7.8.2 and earlier) allows remote attackers to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL targeting the plugin's social login flow. The scope-changed CVSS vector (S:C) confirms cross-context impact, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis.
Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.
Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.
Unauthenticated XSS in miniOrange's WordPress Social Login and Register plugin (versions 7.8.2 and earlier) allows remote attackers to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL targeting the plugin's social login flow. The scope-changed CVSS vector (S:C) confirms cross-context impact, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis.
Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.
Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.