Stored Cross-Site Scripting Vulnerability in Quick Social Login Plugin for WordPress

CVE-2025-10140

What is CVE-2025-10140?

The Quick Social Login plugin for WordPress is susceptible to Stored Cross-Site Scripting, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts through the 'quick-login' shortcode. This vulnerability originates from inadequate input sanitization and output escaping on user-supplied attributes, leading to potential execution of malicious scripts on web pages viewed by other users. It is essential for users of the plugin to take immediate action to protect their sites.

References