CVE-2026-97344

Name of the Vulnerable Software and Affected Versions Wp Social Login and Register Social Counter versions prior to 3.2.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scripts into pages that execute when a user accesses them. This is achieved by chaining two steps: first, invoking the dismiss ajax call endpoint to set the xs social profile image meta flag on their account, which activates an unescaped image output branch in the xs social get avatar() function; second, setting their display name to a script payload that remains unescaped due to the way ENT NOQUOTES is handled.

Recommendations Update Wp Social Login and Register Social Counter to version 3.2.2 or later.