CVE-2025-13737

Name of the Vulnerable Software and Affected Versions Nextend Social Login and Register versions prior to 3.1.22

Description The Nextend Social Login and Register plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation within the unlinkUser function. This allows unauthenticated attackers to unlink a user’s social login by forging a request, provided they can trick a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update Nextend Social Login and Register to version 3.1.22 or later.