Woocommerce Social Login
Approved changes feed: RSS · Atom
cpe:2.3:a:wpwebelite:woocommerce_social_login:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Wpwebelite (8326d902-be86-5bc9-91e3-da6f3224d046) |
|---|---|
| Product | Woocommerce Social Login (465203e8-7640-5e3b-8934-77673e2115bd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-39472 |
vulnerable | 2026-06-08 07:23:06.617931 |
WordPress WooCommerce Social Login plugin < 2.8.3 - Cross Site Request Forgery (CSRF) vulnerability
MEDIUM (4.3)
Cross-Site Request Forgery (CSRF) vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through < 2.8.3.
Published: 2025-04-16T17:15:50.209Z
Updated: 2026-05-12T00:07:51.765Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7503 |
vulnerable | 2026-06-08 06:58:22.313087 |
WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover
CRITICAL (9.8)
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.5. This is due to the use of loose comparison of the activation code in the 'woo_slg_confirm_email_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the userID. This requires the email module to be enabled.
Published: 2024-08-10T02:01:24.069Z
Updated: 2026-04-08T17:32:57.105Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6637 |
vulnerable | 2026-06-08 06:58:20.058288 |
WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password
HIGH (7.3)
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the one-time password for any user, except an Administrator, if they know the email of user.
Published: 2024-07-20T07:37:52.405Z
Updated: 2026-04-08T16:36:07.667Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6636 |
vulnerable | 2026-06-08 06:58:20.056323 |
WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation
CRITICAL (9.8)
The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_email' function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to change the default role to Administrator while registering for an account.
Published: 2024-07-20T07:38:04.704Z
Updated: 2026-04-08T17:01:47.344Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6635 |
vulnerable | 2026-06-08 06:58:20.055795 |
WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass
HIGH (7.3)
The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, excluding an administrator, if they know the email of user.
Published: 2024-07-20T07:38:03.542Z
Updated: 2026-04-08T16:46:23.609Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5871 |
vulnerable | 2026-06-08 06:56:17.662944 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5868 |
vulnerable | 2026-06-08 06:56:17.652165 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37502 |
vulnerable | 2026-06-08 06:39:47.731046 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10114 |
vulnerable | 2026-06-08 06:22:03.596004 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.