CVE-2025-13620: medium-severity vulnerability in roxnor Wp Social Login and Register Social…
Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
roxnor · Wp Social Login and Register Social CounterRelated CVEs — roxnor Wp Social Login and Register Social…
In the same product, most dangerous first.
CVE-2024-9501CRITICALWp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth providerEPSS 0.8%CVE-2026-103898HIGHWp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login CallbackEPSS 0.4%CVE-2024-1763MEDIUMWp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status UpdateEPSS 0.4%CVE-2025-1506MEDIUMWp Social Login and Register Social Counter <= 3.1.0 - Cross-Site Request Forgery to Settings UpdateEPSS 0.2%CVE-2026-97344MEDIUMWp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta WriteEPSS 0.2%