Nextend Facebook Connect Vulnerabilities

[en] The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for unauthenticated attackers to unlink the user's social lo...

Affected:

up to 3.1.22

Fixed in:

3.1.22

Disclosed:

Nov 28, 2025

CVE-2025-13737 on NVD →

The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for unauthenticated attackers to unlink the user's social login v...

CVSS:

4.3

Affected:

up to 3.1.21

Fixed in:

3.1.22

Disclosed:

Nov 27, 2025

CVE-2025-13737 on NVD →

The Nextend Facebook Connect plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script...

CVSS:

6.4

Affected:

up to 3.1.19

Fixed in:

3.1.20

Disclosed:

Sep 22, 2025

CVE-2025-58031 on NVD →

[en] The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_description’ parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

Affected:

up to 3.1.13

Fixed in:

3.1.13

Disclosed:

Mar 2, 2024

CVE-2024-1775 on NVD →

The Nextend Social Login and Register plugin for WordPress is vulnerable to a self-based Reflected Cross-Site Scripting via the ‘error_description’ parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers, wit...

CVSS:

5.4

Affected:

up to 3.1.12

Fixed in:

3.1.13

Disclosed:

Mar 1, 2024

CVE-2024-1775 on NVD →

The Nextend Facebook Connect plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing nonce validation on the store_settings() function. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web sc...

CVSS:

8.8

Affected:

up to 1.5.8

Fixed in:

1.5.9

Disclosed:

Mar 15, 2016

The Nextend Facebook Connect plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing nonce validation on the store_settings() function. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web sc...

Affected:

up to 1.5.9

Fixed in:

1.5.9

Disclosed:

Mar 15, 2016

Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.

CVSS:

6.1

Affected:

up to 1.5.6

Fixed in:

1.5.6

Disclosed:

Jun 24, 2015

CVE-2015-4413 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the new_fb_sign_button function in nextend-facebook-connect.php in Nextend Facebook Connect plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter.

Affected:

up to 1.5.6

Fixed in:

1.5.6

Disclosed:

Jun 24, 2015

CVE-2015-4413 on NVD →

[en] Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a newfb_update_options action.

Affected:

up to 1.5.1

Fixed in:

1.5.1

Disclosed:

Dec 5, 2014

CVE-2014-8800 on NVD →

Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a newfb_update_options action.

CVSS:

7.1

Affected:

up to 1.5.1

Fixed in:

1.5.1

Disclosed:

Feb 12, 2014

CVE-2014-8800 on NVD →

The Nextend Social Login and Register WordPress plugin was affected by a Cross-Site Request Forgery (CSRF) security vulnerability.

Affected:

up to 1.5.8

Fixed in:

1.5.8

Affected:

up to 3.1.19

Fix:

No patched version reported

CVE-2025-58031 on NVD →