CVE-2024-1775 is a reflected cross-site scripting vulnerability in the Nextend Social Login and Register plugin for WordPress, affecting all versions up to 3.1.12. The issue arises from insufficient sanitization and escaping of the 'error_description' parameter, which can be exploited by unauthenticated attackers with subscriber-level access to inject malicious scripts. Successful exploitation against administrator accounts requires Debug mode enabled and leveraging cross-site request forgery plus social engineering. The vulnerability is rated medium severity with CVSS 5.4 and impacts confidentiality and integrity with no availability impact. No patch or remediation details are currently available from the vendor.

This vulnerability allows injection of arbitrary web scripts via a reflected XSS attack, potentially leading to session hijacking or unauthorized actions if an administrator is tricked into clicking a malicious link. The critical impact scenario involves administrator-level account creation through combined exploitation techniques but requires Debug mode enabled, which is not typical in production environments. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable Debug mode in the plugin's Global Settings to prevent the critical exploitation scenario. Additionally, limit subscriber-level access and educate users about phishing and social engineering risks related to clicking unknown links.