CVE-2026-97344: Wp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismissajaxcall endpoint (nonce accessible to Subscribers via any wp-admin page) to set the xssocialprofileimage meta flag on their own account, which activates the unescaped img output branch in xssocialgetavatar, and then setting their display name to a script payload that core's ENTNOQUOTES handling preserves unescaped.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. The required nonce is accessible to Subscribers from any wp-admin page, so installations that allow untrusted users to register or otherwise obtain Subscriber accounts are exposed.
What actions are required to trigger the vulnerable output path?
The attacker must first call the nonce-protected dismiss_ajax_call endpoint to set the xs_social_profile_image flag on their own user account. They must then set their display name to a script payload; the plugin renders it through an unescaped avatar image output branch.
When does the injected script execute?
The payload is stored and executes when a user accesses a page containing the injected avatar output. It does not require further interaction from the attacker after the payload has been stored.
How can I identify potentially affected accounts?
Review user accounts for the xs_social_profile_image meta flag, especially Subscriber or other low-privilege accounts, and inspect associated display names for script-like or unexpected content. The affected plugin versions are all versions through 3.2.1.