CVE-2026-97344 is a stored cross-site scripting vulnerability in the Wp Social Login and Register Social Counter plugin for WordPress, affecting all versions up to 3.2.1. The vulnerability arises from improper neutralization of input during web page generation (CWE-79). An attacker with subscriber-level privileges can chain two actions: first, invoking the nonce-protected dismiss_ajax_call endpoint to set a meta flag on their account, which triggers an unescaped image output branch; second, setting their display name to a malicious script payload that is not properly escaped due to ENT_NOQUOTES handling in core. This results in arbitrary script execution in the context of users viewing the injected content.

The vulnerability allows authenticated low-privilege users to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure and limited integrity impact but does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious user meta changes. Avoid exposing affected plugin functionality to untrusted users.