CVE-2024-1775: Nextend Social Login and Register <= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_description

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-02 · updated 2026-06-17
Weakness: CWE-79

Description

The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_description’ parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers, with access to a subscriber-level account, to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. NOTE: This vulnerability can be successfully exploited on a vulnerable WordPress instance against an OAuth pre-authenticated higher-level user (e.g., administrator) by leveraging a cross-site request forgery in conjunction with a certain social engineering technique to achieve a critical impact scenario (cross-site scripting to administrator-level account creation). However, successful exploitation requires "Debug mode" to be enabled in the plugin's "Global Settings".

Affected products

nextendweb Nextend Social Login and Register: before 3.1.13 — fixed in 3.1.13

How to fix

Upgrade to a fixed version: nextendweb Nextend Social Login and Register 3.1.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1775 or the next vulnerability affects your stack