Unauthenticated Cross‑Site Scripting (XSS) exists in WordPress Social Login and Register plugin version 7.8.1 and earlier. The flaw allows an attacker to inject arbitrary JavaScript into the rendered web page, potentially enabling defacement, credential theft, or session hijacking. This vulnerability is identified as CWE‑79.

The affected systems are WordPress sites using the miniOrange WordPress Social Login and Register plugin version 7.8.1 or older. Any WordPress installation that has this plugin installed and has not been updated is potentially vulnerable.

The CVSS score of 7.1 indicates moderate to high severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, suggesting current exploitation activity is unknown. The vulnerability is exploitable by an unauthenticated attacker, likely via a crafted request that includes malicious script content injected through a plugin field or parameter. Because it does not require privileged access, the risk is significant for sites that expose this plugin to visitors.