CVE-2025-68998

MediumCVSS 5.4

Published: 30/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.

Risk Assessment

An attacker can force an authenticated user to perform unwanted actions in the application without their knowledge, potentially leading to settings changes, account addition, or other operations within their privileges. This can result in account takeover or data breach.

Recommendation

Update the Heateor Social Login plugin to a version higher than 1.1.39. Until then, consider disabling the plugin or implementing additional CSRF tokens in forms.

Other vulnerabilities in Heateor Social Login

CVE-2026-57751High
The Heateor Social Login plugin version 1.1.39 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated administrator.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS