Woocommerce Social Login
Approved changes feed: RSS · Atom
cpe:2.3:a:wpweb:woocommerce_social_login:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Wpweb (21bd5c05-5b3f-5bb1-9946-82120b0607d6) |
|---|---|
| Product | Woocommerce Social Login (ba5097a5-6823-5686-8457-bb248b8dd2d1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-39472 |
vulnerable | 2026-06-08 07:23:06.617051 |
WordPress WooCommerce Social Login plugin < 2.8.3 - Cross Site Request Forgery (CSRF) vulnerability
MEDIUM (4.3)
Cross-Site Request Forgery (CSRF) vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through < 2.8.3.
Published: 2025-04-16T17:15:50.209Z
Updated: 2026-05-12T00:07:51.765Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7503 |
vulnerable | 2026-06-08 06:58:22.313010 |
WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover
CRITICAL (9.8)
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'woo_slg_confirm_email_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the userID. This requires the email module to be enabled.
Published: 2024-08-10T02:01:24.069Z
Updated: 2026-04-08T17:32:57.105Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6636 |
vulnerable | 2026-06-08 06:58:20.056246 |
WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation
CRITICAL (9.8)
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_email' function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to change the default role to Administrator while registering for an account.
Published: 2024-07-20T07:38:04.704Z
Updated: 2026-04-08T17:01:47.344Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6635 |
vulnerable | 2026-06-08 06:58:20.053996 |
WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass
HIGH (7.3)
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user.
Published: 2024-07-20T07:38:03.542Z
Updated: 2026-04-08T16:46:23.609Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5871 |
vulnerable | 2026-06-08 06:56:17.662628 |
WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection
CRITICAL (9.8)
The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'woo_slg_verify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Published: 2024-06-15T03:35:11.306Z
Updated: 2026-04-08T17:35:24.161Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37502 |
vulnerable | 2026-06-08 06:39:47.730284 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10114 |
vulnerable | 2026-06-08 06:22:03.594205 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.