Input validation vulnerability in Nextend Social Login and Register 1.5.8

The Nextend Facebook Connect plugin for WordPress is vulnerable to a security issue called Cross-Site Request Forgery. This affects all versions of the plugin up to and including version 1.5.8. The vulnerability is caused by the lack of nonce validation on the store_settings() function. This means an unauthenticated attacker can update the plugin settings and inject malicious web scripts by sending a forged request to an unsuspecting site administrator. This could be done by getting the administrator to click on a malicious link.