Social Connect Vulnerabilities

[en] The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existi...

Affected:

up to 1.2

Fix:

No patched version reported

Disclosed:

May 8, 2024

CVE-2024-4393 on NVD →

The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing us...

CVSS:

9.8

Affected:

up to 1.2

Fix:

No patched version reported

Disclosed:

May 7, 2024

CVE-2024-4393 on NVD →

This plugin is prone to a cross site scripting vulnerability in diagnostics/test.php testing parameter. Update the plugin.

Affected:

up to 0.10.2

Fixed in:

0.10.2

Disclosed:

Aug 1, 2014

[en] Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the testing parameter.

Affected:

up to 0.10.2

Fixed in:

0.10.2

Disclosed:

Jul 2, 2014

CVE-2014-4551 on NVD →

Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 0.10.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the testing parameter.

CVSS:

6.1

Affected:

up to 0.10.1

Fixed in:

0.10.2

Disclosed:

May 25, 2014

CVE-2014-4551 on NVD →

The Social Connect WordPress plugin was affected by a diagnostics/test.php testing Parameter Reflected XSS security vulnerability.

Affected:

up to 0.10.2

Fixed in:

0.10.2