CVE-2026-16261

The login-social (also known as Huge IT Login ) WordPress plugin, version 1.0.4 and below , is vulnerable to an unauthenticated account takeover . The root cause is a failure to validate password-reset requests against a specific reset key or the requester's identity. Additionally, the plugin iss...