CVE-2024-1775

The Nextend Social Login and Register plugin through version 3.1.12 contains a reflected cross-site scripting vulnerability in the 'error_description' parameter due to inadequate input validation and output encoding. An unauthenticated attacker with subscriber access can inject malicious scripts that execute when a user clicks a crafted link, and with Debug mode enabled, could leverage cross-site request forgery techniques to target authenticated administrators and potentially create administrator accounts. This vulnerability was patched in version 3.1.13.

Based on public CVE data (MITRE/NVD).