Filtered by vendor Miniorange
Subscriptions
Total
84 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-28008 | 2 Miniorange, Wordpress | 2 Oauth Single Sign On – Sso (oauth Client), Wordpress | 2026-08-14 | 9.8 Critical |
| Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. | ||||
| CVE-2026-28148 | 2 Miniorange, Wordpress | 2 Headless Single Sign On, Wordpress | 2026-08-14 | 9.8 Critical |
| Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. | ||||
| CVE-2026-28149 | 2 Miniorange, Wordpress | 2 Headless Single Sign On, Wordpress | 2026-08-14 | 9.8 Critical |
| Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. | ||||
| CVE-2026-61967 | 2 Miniorange, Wordpress | 2 Otp Verification, Wordpress | 2026-08-14 | 9.8 Critical |
| Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. | ||||
| CVE-2026-61979 | 2 Miniorange, Wordpress | 2 Saml Sp Single Sign On, Wordpress | 2026-08-13 | 8.1 High |
| Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. | ||||
| CVE-2026-16619 | 2 Miniorange, Wordpress | 2 Miniorange 2fa, Wordpress | 2026-08-07 | 7.5 High |
| The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account. | ||||
| CVE-2026-65520 | 2 Miniorange, Wordpress | 2 Wp Oauth Server, Wordpress | 2026-08-06 | 9.3 Critical |
| Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. | ||||
| CVE-2026-16036 | 2 Miniorange, Wordpress | 2 Miniorange 2fa, Wordpress | 2026-08-05 | 7.5 High |
| The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts. | ||||
| CVE-2026-14300 | 2 Miniorange, Wordpress | 2 Wordpress Social Login And Register (discord, Google, Twitter, Linkedin), Wordpress | 2026-08-05 | 8.1 High |
| The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured. | ||||
| CVE-2026-16035 | 2 Miniorange, Wordpress | 2 Miniorange 2fa, Wordpress | 2026-08-05 | 4.3 Medium |
| The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes. | ||||
| CVE-2026-59545 | 2 Miniorange, Wordpress | 2 Discord Integration, Wordpress | 2026-08-02 | 8.1 High |
| Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. | ||||
| CVE-2026-61957 | 2 Miniorange, Wordpress | 2 Otp Verification, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. | ||||
| CVE-2026-65561 | 2 Miniorange, Wordpress | 2 Wordpress Social Login And Register, Wordpress | 2026-07-27 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions. | ||||
| CVE-2021-47979 | 3 Miniorange, Wordpress, Wpbackitup | 3 Backup And Restore, Wordpress, Backup And Restore Wordpress | 2026-07-15 | 8.8 High |
| WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory. | ||||
| CVE-2026-5343 | 2 Drupal, Miniorange | 2 Saml Sso - Service Provider, Saml Sso - Service Provider | 2026-06-01 | 7.4 High |
| Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4. | ||||
| CVE-2026-42731 | 2 Miniorange, Wordpress | 2 Otp Verification, Wordpress | 2026-05-30 | 9.8 Critical |
| Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9. | ||||
| CVE-2024-25902 | 2 Miniorange, Wordpress | 2 Malware Scanner, Wordpress | 2026-04-28 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Scanner: from n/a through 4.7.2. | ||||
| CVE-2023-41873 | 2 Miniorange, Wordpress | 2 Saml Sp Single Sign On, Wordpress | 2026-04-28 | 4.3 Medium |
| Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4. | ||||
| CVE-2023-25455 | 1 Miniorange | 1 Wordpress Social Login And Register \(discord\, Google\, Twitter\, Linkedin\) | 2026-04-28 | 5.3 Medium |
| Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0. | ||||
| CVE-2023-24375 | 2 Miniorange, Wordpress | 2 Wordpress Social Login And Register (discord, Google, Twitter, Linkedin), Wordpress | 2026-04-28 | 3.5 Low |
| Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14. | ||||