Unauthenticated Cross‑Site Scripting is present in WordPress Social Login and Register plugin versions 7.8.2 and earlier. The flaw allows an attacker to inject malicious JavaScript that is rendered in the browser when a user views a page containing vulnerable input. This can lead to defacement, cookie theft, session hijacking, and the execution of additional malicious actions on behalf of the user. The weakness corresponds to CWE‑79, an input validation and output encoding issue.

The issue affects the miniOrange WordPress Social Login and Register plugin for WordPress. Any installation of version 7.8.2 or earlier is vulnerable. Upgrading to at least 7.9.0 removes the vulnerability.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw does not require authentication or special privileges, so the attack path is readily exploitable via the public web interface of a WordPress site that uses the plugin. Consequently, the risk of exploitation is considered high for sites that have not applied the available fix.