PT-2025-48311 · WordPress · Nextend Social Login/Register

Published 2025-11-28 · Updated 2025-11-28 · CVE-2025-13737

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextend Social Login and Register versions prior to 3.1.22

Description The Nextend Social Login and Register plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation within the unlinkUser function. This allows unauthenticated attackers to unlink a user’s social login by forging a request, provided they can trick a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update Nextend Social Login and Register to version 3.1.22 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-13737

Affected Products

Nextend Social Login/Register

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13737 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9c6b747e-d267-4fd3-a4fd-022aa657c796?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3404174/nextend-facebook-connect/trunk/includes/provider.php · Note
• https://twitter.com/CVEnew/status/1994250828044009505 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1994305796553810160 · Twitter Post
• https://plugins.trac.wordpress.org/browser/nextend-facebook-connect/tags/3.1.21/includes/provider.php#L772 · Note
• https://t.me/CVEtracker/38417 · Telegram Post
• https://t.me/cveNotify/144204 · Telegram Post