Qué hace este plugin

• Slug: wp-social
• Autor: Roxnor
• 80000+ instalaciones activas
• 92/100 calificación (67 reseñas en wordpress.org)
• 1010429 descargas totales
• En WordPress.org desde 2010-08-19

socialsocial countersocial loginsocial shareWordPress Social login and register

Estado de mantenimiento

• Última actualización: 2026-05-21 6:47am GMT
• Probado hasta WordPress: 7.0.2
• Requiere PHP: 7.4+

Vulnerabilidades conocidas

5 CVEs conocidos registrados para Wp Social.

CVE-2025-13620

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-9501

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-1763

Update the WordPress Wp Social plugin to the latest available version (at least 3.0.1). Krzysztof Zając discovered and reported this Broken Access Control vulnerability in WordPress Wp Social Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.0.1. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-47160

The Wp Social plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.9.0. This is due to missing capability checks on the 'export_users_content_csv' function. This makes it possible for authenticated attackers with minimal permissions such as subscribers to export user content such as user logins and passwords of various social media providers.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-1506

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. This is due to missing or incorrect nonce validation on the counter_access_key_setup() function. This makes it possible for unauthenticated attackers to update social login provider settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• AddToAny Share Buttons — 300000+ instalaciones activas — 94/100 (1113)
• Social Media Share Buttons & Social Sharing Icons — 100000+ instalaciones activas — 96/100 (5334) — PHP máx. 8.4
• Metricool – Social media and site statistics — 80000+ instalaciones activas — 84/100 (11) — PHP máx. 8.4
• Ocean Social Sharing — 60000+ instalaciones activas — 90/100 (11) — PHP máx. 8.4
• Buttonizer – Social Media Share Buttons, Social Icons, & Social Feeds — 40000+ instalaciones activas — 96/100 (396) — PHP máx. 8.4