Nextend Social Login and Register <= 3.1.12 — Reflected Self-Based Cross-Site Scripting via error_description

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Nextend Social Login and Register.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 3.1.13, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Nextend Social Login and Register to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Tobias Weißhaar (kun_19).

The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_description’ parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers, with access to a subscriber-level account, to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. NOTE: This vulnerability can be successfully exploited on a vulnerable WordPress instance against an OAuth pre-authenticated higher-level user (e.g., administrator) by leveraging a cross-site request forgery in conjunction with a certain social engineering technique to achieve a critical impact scenario (cross-site scripting to administrator-level account creation). However, successful exploitation requires "Debug mode" to be enabled in the plugin's "Global Settings".

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Mar 1, 2024

   CVE published

   Severity medium, CVSS 5.4

2. Nov 13, 2026

   Record last updated