WordPress Plugin Vulnerabilities

WordPress Social Login and Register < 7.6.1 - Unauthenticated Arbitrary Content Deletion

Description

The plugin does not have authorisation in some AJAX actions, allowing unauthenticated users to call them and perform unauthorised actions, such as delete social profile data

Affects Plugins

Plugin icon
miniorange-login-openid
Fixed in 7.6.1

References

CVE
CVE-2023-25455

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Rafshanzani Suhada
Verified
No
WPVDB ID
a558ddc5-65bf-4d9c-b84d-88f34189a862

Timeline

Publicly Published
2023-02-13 (about 3 years ago)
Added
2023-04-26 (about 3 years ago)
Last Updated
2023-04-26 (about 3 years ago)

Other

Published
Title
Published
2025-03-31
Title
Cal.com <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-02-13
Title
Synved Shortcodes <= 1.6.36 - Contributor+ Stored XSS
Published
2025-01-27
Title
Philantro – Donations and Donor Management < 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate Shortcode
Published
2026-01-06
Title
Customer Reviews for WooCommerce < 5.94.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter
Published
2020-01-24
Title
WP DS FAQ Plus < 1.4.2 - Stored Cross-Site Scripting (XSS)