Wordpress Social Login And Register
Monthly
Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.
Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.
Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.
Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.