Wp Social Login And Register Social Counter
Monthly
Authentication bypass in Wp Social Login and Register Social Counter 3.2.2 and earlier allows an unauthenticated remote attacker to obtain a fully authenticated WordPress session as an existing user, including an administrator, when the site has the bundled Facebook or Twitter social-login provider configured and active. The plugin's social-login REST callback trusts the OAuth provider's email string and calls wp_set_auth_cookie() without a password check, while the intended email-verification guard is ineffective for the bundled Hybridauth Facebook and Twitter adapters. No public exploit is identified at time of analysis, and the provided intelligence does not confirm active exploitation, but the assessed prerequisites and high impact make this a this-week priority.
Stored cross-site scripting in the Wp Social Login and Register Social Counter WordPress plugin (all versions up to and including 3.2.1) lets any authenticated account with subscriber-level access or above plant a script payload that executes in the browser of anyone who later views the poisoned avatar. Exploitation is a two-step chain: the attacker first invokes the plugin's nonce-only dismiss_ajax_call AJAX endpoint (the nonce is exposed to subscribers on any wp-admin page) to set the xs_social_profile_image user-meta flag on their own account, then stores a script payload in their display name, which xs_social_get_avatar echoes unescaped into an img alt attribute because WordPress core's ENT_NOQUOTES handling preserves the quotes needed to break out. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it is a moderate-severity issue; no public exploit code has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV), and the impact only materializes when a victim - ideally a privileged user such as an administrator - browses a page rendering the attacker's avatar.
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp_social/v1/ REST API endpoint in. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.9.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication bypass in Wp Social Login and Register Social Counter 3.2.2 and earlier allows an unauthenticated remote attacker to obtain a fully authenticated WordPress session as an existing user, including an administrator, when the site has the bundled Facebook or Twitter social-login provider configured and active. The plugin's social-login REST callback trusts the OAuth provider's email string and calls wp_set_auth_cookie() without a password check, while the intended email-verification guard is ineffective for the bundled Hybridauth Facebook and Twitter adapters. No public exploit is identified at time of analysis, and the provided intelligence does not confirm active exploitation, but the assessed prerequisites and high impact make this a this-week priority.
Stored cross-site scripting in the Wp Social Login and Register Social Counter WordPress plugin (all versions up to and including 3.2.1) lets any authenticated account with subscriber-level access or above plant a script payload that executes in the browser of anyone who later views the poisoned avatar. Exploitation is a two-step chain: the attacker first invokes the plugin's nonce-only dismiss_ajax_call AJAX endpoint (the nonce is exposed to subscribers on any wp-admin page) to set the xs_social_profile_image user-meta flag on their own account, then stores a script payload in their display name, which xs_social_get_avatar echoes unescaped into an img alt attribute because WordPress core's ENT_NOQUOTES handling preserves the quotes needed to break out. Scored CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), it is a moderate-severity issue; no public exploit code has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV), and the impact only materializes when a victim - ideally a privileged user such as an administrator - browses a page rendering the attacker's avatar.
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp_social/v1/ REST API endpoint in. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.9.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.