Heateor Social Login WordPress

Heateor Social Login WordPress has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 5 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (57%). Other recurring categories include Cross-Site Request Forgery (CSRF), Improper Authentication.

5 of the records (71%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2025.

6 independent researchers contributed these findings, most of them (2) reported by LVT-tholv2k.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage71%

Open

Fixed

Get automatic notifications for all Heateor Social Login WordPress vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2026-57751

Heateor Social Login WordPress <= 1.1.39 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

7 records


2026-07-01 00:00	Heateor Social Login WordPress <= 1.1.39 - Cross-Site Request Forgery Heateor Social Login WordPress <= 1.1.39	`CVE-2026-57751`	4.3 Medium	ParkHyunWoo	No
2025-12-26 00:00	Heateor Social Login <= 1.1.39 - Cross-Site Request Forgery Heateor Social Login WordPress <= 1.1.39	`CVE-2025-68998`	4.3 Medium	Trương Hữu Phúc (truonghuuphuc)	No
2024-11-05 00:00	Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider Heateor Social Login WordPress <= 1.1.35	`CVE-2024-10020`	8.1 High	wesley (wcraft)	Yes
2024-06-06 00:00	Heateor Social Login WordPress <= 1.1.32 - Unauthenticated Stored Cross-Site Scripting Heateor Social Login WordPress <= 1.1.32	`CVE-2024-35706`	7.2 High	LVT-tholv2k	Yes
2024-06-06 00:00	Heateor Social Login WordPress <= 1.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting Heateor Social Login WordPress <= 1.1.32	`CVE-2024-35707`	6.4 Medium	LVT-tholv2k	Yes
2024-05-08 00:00	Heateor Social Login WordPress <= 1.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting Heateor Social Login WordPress <= 1.1.31	`CVE-2024-32674`	6.4 Medium	Daiki Sato	Yes
2024-01-31 00:00	Heateor Social Login <= 1.1.30 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Heateor Social Login WordPress <= 1.1.30	`CVE-2024-24712`	6.4 Medium	Ngô Thiên An (ancorn_)	Yes

Showing 1–7 of 7 reports