Wp Social Login and Register Social Counter
Wp Social Login and Register Social Counter adds social login, registration, and social counter features to WordPress.
Wp Social Login and Register Social Counter (wp-social) is a WordPress plugin with 4 published CVE records in this archive. The latest tracked vulnerability was published Oct 03, 2026; the highest published CVSS base score is 9.8.
wp-socialCVE-2026-97344: Wp Social: Stored XSS through avatar metadata
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xs_social_profile_image meta flag on their own account, which activates the unescaped img output branch in xs_social_get_avatar, and then setting their display name to a script payload that core's ENT_NOQUOTES handling preserves unescaped. The official changelog confirms the fixed release as 3.2.2.
| Safe version |
|
||
|---|---|---|---|
| Oct 03, 2026 |
CVE-2026-97344
Wp Social: Stored XSS through avatar metadata
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xs_social_profile_image meta flag on their own account, which activates the unescaped img output branch in xs_social_get_avatar, and then setting their display name to a script payload that core's ENT_NOQUOTES handling preserves unescaped. The official changelog confirms the fixed release as 3.2.2.
|
3.2.2 |
CVE6.4
NVDPending
|
| Feb 28, 2025 |
CVE-2025-1506
Wp Social Login and Register Social Counter: Cross-site request forgery
Wp Social Login and Register Social Counter is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Oct 26, 2024 |
CVE-2024-9501
Wp Social Login and Register Social Counter: Privilege escalation or authentication bypass
Wp Social Login and Register Social Counter is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE9.8
NVDPending
|
| Jan 19, 2024 |
CVE-2022-47160
Wp Social Login and Register Social Counter: A security weakness
Wp Social Login and Register Social Counter is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD6.5
|