Plugin icon

Social Login, Social Sharing by miniOrange

miniorange-login-openid

Vulnerabilities:

13

Last Updated:

September 17, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-08-28
Title
Social Login, Social Sharing by miniOrange < 7.9.0 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 7.9.0
CVSS
7.2 (high)
Published
2026-08-18
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.2 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 7.8.2
CVSS
7.2 (high)
Published
2026-07-24
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 7.8.1
CVSS
5.5 (medium)
Published
2026-07-10
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow
Fixed in
Fixed in 7.8.0
CVSS
9.8 (critical)
Published
2026-07-08
Title
miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
Fixed in
Fixed in 7.8.0
CVSS
8.1 (high)
Published
2025-09-28
Title
Social Login and Register <= 7.7.0 - Authenticated (Administrator+) Local File Inclusion
Fixed in
No known fix
CVSS
6.6 (medium)
Published
2025-05-21
Title
WordPress Social Login and Register < 7.7.0 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 7.7.0
CVSS
8.1 (high)
Published
2025-03-07
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon < 200.3.10 - Authentication Bypass
Fixed in
Fixed in 200.3.10
CVSS
8.1 (high)
Published
2023-11-09
Title
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.6.7 - Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 7.6.7
CVSS
8.8 (high)
Published
2023-06-28
Title
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.6.5 - Authentication Bypass
Fixed in
Fixed in 7.6.5
CVSS
9.8 (critical)
Published
2023-02-15
Title
WordPress Social Login and Register < 7.6.0 - Admin+ Stored XSS
Fixed in
Fixed in 7.6.0
CVSS
3.5 (low)
Published
2023-02-15
Title
WordPress Social Login and Register < 7.5.15 - Multiple CSRF
Fixed in
Fixed in 7.5.15
CVSS
4.3 (medium)
Published
2023-02-13
Title
WordPress Social Login and Register < 7.6.1 - Unauthenticated Arbitrary Content Deletion
Fixed in
Fixed in 7.6.1
CVSS
5.3 (medium)