CVE-2025-39472

CVE-2025-39472 corresponds to a CSRF vulnerability in the WPWooCommerce Social Login plugin (WooCommerce Social Login). Affected versions are 2.8.2 and earlier; the issue arises from Cross-Site Request Forgery that could allow unauthorized actions on behalf of a user. The fix is to upgrade to ver...

CVE-2024-5871

CVE-2024-5871 : The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated PHP Object Injection in all versions up to and including 2.6.2, via deserialization of untrusted input from the vulnerable parameter woo_slg_verify . An attacker could inject a PHP object; while n...

CVE-2024-37502

CVE-2024-37502 affects the WooCommerce – Social Login plugin for WordPress, with affected versions up to 2.6.3. The vulnerability is described in the connected Wordfence entry as an unauthenticated PHP Object Injection resulting from deserialization of untrusted data. Impact is described as high ...

CVE-2024-10114

CVE-2024-10114 – WooCommerce - Social Login (WordPress) Affected product: WooCommerce - Social Login plugin for WordPress.Vulnerability: authentication bypass due to insufficient verification on the user returned by the social login token (root cause: token user verification flaw).Impact (per sou...

CVE-2024-5868

The CVE-2024-5868 entry concerns the WooCommerce - Social Login plugin for WordPress. Affected versions (

CVE-2024-6635

CVE-2024-6635 affects the WooCommerce - Social Login plugin for WordPress. Versions up to and including 2.7.3 are vulnerable due to insufficient controls in the woo_slg_login_email function, enabling unauthenticated users to log in as any existing user except administrators if they know the user’...

CVE-2024-7503

CVE-2024-7503 refers to a authentication bypass in the WooCommerce - Social Login plugin for WordPress (affected versions up to and including 2.7.5). The root cause is a loose comparison of the activation code in the woo_slg_confirm_email_user function, enabling unauthenticated attackers (with ac...

CVE-2024-6637

CVE-2024-6637 describes an unauthenticated privilege-escalation in the WordPress plugin WooCommerce - Social Login (versions up to 2.7.3) due to lack of brute-force controls on a weak one-time password. Exploitation status is not indicated; the CVSS base score is 7.3 (HIGH) with NETWORK attack ve...

CVE-2024-6636

CVE-2024-6636 affects the WooCommerce – Social Login plugin for WordPress up to version 2.7.3. The issue is a missing capability check in the woo_slg_login_email function, allowing unauthenticated attackers to modify data by changing the default user role to Administrator during registration. Pro...