CVE-2026-65561 in Social Login and Register Plugin
Summary
by MITRE • 07/27/2026
Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/27/2026
WordPress Social Login and Register plugin versions up to 7.8.0 contain a contributor cross site scripting vulnerability that allows authenticated users with contributor level privileges to execute malicious scripts in the context of other users' browsers. This vulnerability stems from insufficient input validation and output escaping mechanisms within the plugin's handling of user-provided data, particularly in social login and registration flows where contributor users can submit content that gets rendered without proper sanitization.
The technical flaw manifests when a contributor user submits malicious script code through social login parameters or registration forms that are subsequently processed and displayed on admin interfaces or public pages. The vulnerability is classified as CWE-79 - Improper Neutralization of Input During Web Page Generation, which occurs when web applications fail to properly escape or validate data before incorporating it into dynamic web content. This allows attackers to inject malicious javascript payloads that can execute in the browser context of other users with higher privileges, potentially enabling session hijacking, privilege escalation, or data exfiltration.
The operational impact of this vulnerability extends beyond simple XSS exploitation as it provides a foothold for more sophisticated attacks within WordPress environments. Contributors typically have limited capabilities such as publishing posts and managing their own content, but this vulnerability allows them to bypass normal security boundaries through the social login functionality. An attacker could craft malicious payloads that target administrators or other high-privilege users who view the contributor's content, leading to potential full system compromise through techniques such as cookie theft, CSRF attacks, or redirection to malicious sites. This vulnerability particularly affects multi-user WordPress installations where contributors might interact with admin interfaces or where social login features are enabled.
Mitigation strategies should focus on immediate patching of the plugin to version 7.8.1 or later where the XSS vulnerability has been addressed through proper input validation and output escaping mechanisms. Administrators should also implement additional security measures such as role-based access controls, regular security audits of installed plugins, and monitoring for unusual contributor activities. The ATT&CK framework categorizes this vulnerability under T1059 - Command and Scripting Interpreter and T1566 - Phishing, as it enables attackers to use social engineering techniques combined with script injection to compromise systems. Organizations should also consider implementing Content Security Policy headers to limit script execution contexts and employ web application firewalls to detect and block malicious payloads. Regular security updates and vulnerability assessments of all WordPress plugins remain critical defensive measures against similar issues in the future.