Plugin icon

miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator)

miniorange-2-factor-authentication

Vulnerabilities:

7

Last Updated:

April 13, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2025-08-23
Title
miniOrange's Google Authenticator < 6.1.2 - Missing Authorization
Fixed in
Fixed in 6.1.2
CVSS
4.3 (medium)
Published
2023-04-19
Title
miniOrange's Google Authenticator < 5.6.6 - Missing Authorization to Plugin Settings Change
Fixed in
Fixed in 5.6.6
CVSS
7.5 (high)
Published
2022-10-31
Title
miniOrange's Google Authenticator < 5.6.2 - Subscriber+ Settings Update
Fixed in
Fixed in 5.6.2
CVSS
5.4 (medium)
Published
2022-06-27
Title
miniOrange's Google Authenticator < 5.5.75 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.5.75
CVSS
6.1 (medium)
Published
2022-06-06
Title
miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 5.5.6
CVSS
3.4 (low)
Published
2022-02-28
Title
miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion
Fixed in
Fixed in 5.5
CVSS
10.0 (critical)
Published
2021-08-10
Title
miniOrange's Google Authenticator < 5.4.40 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.4.40
CVSS
7.1 (high)