CVE-2026-97344 roxnor CVE debrief

Who should care

WordPress site administrators and defenders should assess exposure and apply patches or mitigations to prevent exploitation of this vulnerability. They should also verify if the Wp Social Login and Register Social Counter plugin is installed and if the version is 3.2.1 or earlier. Additionally, they should implement additional security measures such as input validation and output escaping for user-generated content and monitor for suspicious activity.

Why it matters

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute. Defenders should assess exposure and apply patches or mitigations to prevent exploitation.

• Authenticated attackers with subscriber-level access can inject web scripts that execute when a user accesses an injected page.
• The vulnerability requires chaining two steps: setting the xs_social_profile_image meta flag and then setting the display name to a script payload.
• Defenders should verify if the Wp Social Login and Register Social Counter plugin is installed and if the version is 3.2.1 or earlier.
• Remediation priority is medium for WordPress site administrators and defenders.

Technical summary

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access to inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability requires chaining two steps: setting the xs_social_profile_image meta flag and then setting the display name to a script payload. Defenders should verify if the Wp Social Login and Register Social Counter plugin is installed and if the version is 3.2.1 or earlier.

Defensive priority

Medium priority for WordPress site administrators and defenders to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by checking if the Wp Social Login and Register Social Counter plugin is installed and if the version is 3.2.1 or earlier.
• Apply patches or updates to the plugin to fix the vulnerability.
• Implement additional security measures such as input validation and output escaping for user-generated content.
• Monitor for suspicious activity and implement incident response plans.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows authenticated attackers with subscriber-level access to inject arbitrary web scripts via the avatar alt attribute. This requires chaining two steps: setting the xs_social_profile_image meta flag and then setting the display name to a script payload.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.