Wp Social <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute

ID

WPSEC-2026-0035

Plugin

Wp Social Login and Register Social Counter (wp-social)

Affected

from 1.3.8 before 3.2.2

Remediation

Update to 3.2.2 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22

Attack surface

Wp Social on WPSec AttackSurface

Fix released

2026-09-30

Published

2026-10-01

Description

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the avatar alt attribute in versions 1.3.8 up to, and including, 3.2.1. This is due to insufficient output escaping in the plugin's get_avatar filter override, which builds the avatar img tag from the alt, image URL and size values without escaping for any user who has the xs_social_profile_image user meta set. Users who signed in through a social provider have this meta set by the plugin, and from version 1.4.4 any logged-in user can set it on their own account through the wpmet-notices notice dismissal AJAX action, which lacked a capability check and accepted any user meta key. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts through their display name that execute whenever their avatar is rendered with the name as alt text, for example by the core Avatar block.

References

• https://wpsec.com/vuln/WPSEC-2026-0035/
• https://plugins.svn.wordpress.org/wp-social/tags/3.2.2/
• https://wordpress.org/plugins/wp-social/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS