This vulnerability (CVE-2024-35706) in Heateor Social Login is caused by improper input sanitization leading to Cross-Site Scripting (CWE-79). It affects all versions up to 1.1.32. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates it can be exploited remotely over the network with low attack complexity, no privileges required, but user interaction is needed. Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system. No patch or official fix has been published yet.

Exploitation of this XSS vulnerability can allow attackers to execute arbitrary scripts in the context of users visiting the affected web pages, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.1. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying workarounds such as disabling the plugin or restricting its use to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.