The Heateor Login – Social Login Plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of user-supplied input in the 'Heateor_Facebook_Login' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the affected pages. This vulnerability affects all plugin versions up to 1.1.9. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impact on confidentiality and integrity but not availability. No known exploits in the wild or vendor patches are documented at this time.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to unauthorized actions such as session hijacking or data theft. The impact affects confidentiality and integrity but does not affect availability. Since the vulnerability requires authenticated access, the risk is limited to environments where such user roles exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access and above to trusted users only. Avoid using the 'Heateor_Facebook_Login' shortcode in content or disable the plugin if possible to mitigate risk.