WordPress security by component
WordPress Social Login and Register
Plugin description
WordPress Social Login and Register is a WordPress component with 10 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
miniorange-login-openidLatest vulnerability
CVE-2026-65561: WordPress Social Login contributor input permits cross-site scripting
WordPress Social Login and Register through 7.8.0 lets a Contributor supply attacker-controlled input that reaches a browser-executable output context without adequate neutralization. The payload can execute in the site's origin when another user views the crafted output. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, field, parameter or rendering function.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-65561
WordPress Social Login contributor input permits cross-site scripting
WordPress Social Login and Register through 7.8.0 lets a Contributor supply attacker-controlled input that reaches a browser-executable output context without adequate neutralization. The payload can execute in the site's origin when another user views the crafted output. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, field, parameter or rendering function.
|
7.8.1 |
CVE6.5
NVDPending
|
| Jul 10, 2026 |
CVE-2026-12761
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn): Privilege escalation or authentication bypass
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 7.7.0.
|
> 7.7.0 |
CVE9.8
NVDPending
|
| Dec 30, 2025 |
CVE-2025-68974
WordPress Social Login and Register: Filesystem traversal
WordPress Social Login and Register is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE6.6
NVDPending
|
| May 23, 2025 |
CVE-2025-47670
WordPress Social Login and Register: Filesystem traversal
WordPress Social Login and Register is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.1
NVDPending
|
| Dec 09, 2024 |
CVE-2023-25455
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): A security weakness
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 09, 2024 |
CVE-2023-24375
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): A security weakness
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE3.5
NVDPending
|
| May 17, 2024 |
CVE-2023-47683
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Privilege escalation or authentication bypass
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.0
NVDPending
|
| Jun 29, 2023 |
CVE-2023-2982
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Privilege escalation or authentication bypass
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE9.8
NVDPending
|
| May 23, 2023 |
CVE-2023-23706
Miniorange Login Openid: Cross-site request forgery
Miniorange Login Openid is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD8.8
|
| Apr 25, 2023 |
CVE-2023-23710
Miniorange Login Openid: Cross-site scripting
Miniorange Login Openid is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.9
NVD4.8
|