The Quick Social Login plugin allows a contributor‑level or higher authenticated user to supply attributes to its ‘quick-login’ shortcode. Because the plugin does not properly sanitize or escape these attributes, the data is stored and later rendered in webpages. An attacker can inject malicious JavaScript that will execute for any user who views the affected page. This flaw can be used to hijack user sessions, deface content, or exfiltrate credentials and other sensitive data. The weakness is a classic stored XSS (CWE‑79).

All WordPress installations that employ the Quick Social Login plugin version 1.4.6 or earlier are susceptible. The plugin is distributed under the vendor name andreiigna and is widely used in WordPress sites that support social login functionalities. The vulnerable code resides in the plugin’s shortcode handling, and any page that includes the short‑code can be exploited.

The flaw receives a CVSS base score of 6.4, indicating moderate severity. The EPSS score is reported as < 1 %, suggesting a very low likelihood of exploitation in the wild at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already have contributor‑level or higher access to the site, so privilege escalation is necessary before the stored XSS can be deployed. Once the attribute is injected, the malicious script will run on page load for all users who view the affected page.