The Heateor Login – Social Login Plugin is vulnerable to stored cross‑site scripting through its 'Heateor_Facebook_Login' shortcode. The plugin does not sanitize or escape user‑supplied attributes, allowing an attacker who is authenticated with contributor level access or higher to inject arbitrary JavaScript. When a site visitor views a page containing the malicious shortcode, the injected script runs in the visitor’s browser.

WordPress sites that have the Heateor Login – Social Login Plugin version 1.1.9 or earlier installed are affected. The vulnerability applies to any page that contains the vulnerable shortcode, regardless of the WordPress core version.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is not widespread at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with contributor or higher privileges; once authenticated, they can embed malicious JavaScript into the shortcode, which will execute for every user who views the affected page.