CVE-2026-82229: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in miniOrange WordPress Social Login and Register

CVE-2026-82229 is an unauthenticated cross-site scripting (XSS) vulnerability in the miniOrange WordPress Social Login and Register plugin, affecting versions up to 7.8.2. The flaw arises from improper neutralization of input during web page generation (CWE-79), enabling attackers to inject malicious scripts that can execute in the context of the victim's browser. The vulnerability has a CVSS 3.1 base score of 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated as low. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary scripts in the context of users visiting affected web pages. This may lead to partial disclosure of sensitive information, modification of data, and disruption of service. The CVSS score reflects a high severity due to the potential combined impact on confidentiality, integrity, and availability, despite requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as disabling the affected plugin or restricting access to vulnerable functionality. Monitor official miniOrange communications for updates and apply patches promptly once available.