CVE-2026-82229

CVE-2026-82229 is an unauthenticated cross-site scripting (XSS, CWE-79) flaw in the Social Login and Register WordPress plugin (developed by miniOrange), affecting all versions up to and including 7.8.2. An unauthenticated remote attacker can inject malicious script content via a crafted web request targeting the plugin's vulnerable functionality; because user interaction is required (CVSS UI:R) and the scope is changed, the injected script executes when another user — such as a logged-in administrator — views the attacker-crafted page or link. Successful exploitation allows the attacker to run arbitrary JavaScript in the victim's browser, potentially stealing session cookies, performing actions on their behalf, or making low-impact changes to the viewed content (CVSS 3.1: 7.1, C:L/I:L/A:L). Any WordPress site running Social Login and Register version 7.8.2 or earlier is affected. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns only a ~0.1% probability of exploitation within the next 30 days.

What to do: Update Social Login and Register to the latest available release (any version above 7.8.2; the exact patched version is not specified in the available data). Until patched, consider temporarily disabling the plugin or applying WAF rules that block unauthenticated requests targeting the plugin's login/registration endpoints, and review access logs for suspicious unauthenticated requests. Administrators should also check for unexpected changes (unknown admin accounts, altered settings), since XSS in an admin's browser can be used to establish persistence.