CVE-2014-4551: Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and ear...

Security readout for executives and security teams

CVE-2014-4551 is a cross-site scripting issue in the WordPress Social Connect plugin. If a site runs version 1.0.4 or earlier, an attacker may be able to inject script or HTML through the plugin’s diagnostic test page. Business risk depends on whether the plugin is installed and reachable. Exposure is likely limited to WordPress sites that installed Social Connect plugin version 1.0.4 or earlier and retain the diagnostics/test.php endpoint. The supplied affected-product metadata is incomplete, so validation should rely on local plugin inventory and file review. Treat this as a targeted WordPress plugin exposure rather than a platform-wide emergency. Public sites running the affected plugin should be checked promptly because XSS can support session theft, phishing, or administrative action abuse, but the provided sources do not prove active exploitation. Mitigation focus: Inventory WordPress sites for Social Connect plugin 1.0.4 or earlier.; Check vendor or project guidance for a fixed version or official mitigation.; Remove or disable the affected plugin if it is not required..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.