WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
miniorange-saml-20-single-sign-on
Published
2020-01-28
Title
SAML SP Single Sign On < 4.8.84 - Cross-Site Scripting (XSS) via Crafted SAML XML Response
Slug
miniorange-saml-20-single-sign-on
Published
2023-01-06
Title
miniOrange WordPress SAML SSO Standard < 16.0.8 - Open Redirect in SSO login
Slug
miniorange-saml-20-single-sign-on
Published
2023-01-06
Title
miniOrange WordPress SAML SSO Premium < 12.1.0 - Open Redirect in SSO login
Slug
miniorange-saml-20-single-sign-on
Published
2023-01-06
Title
miniOrange WordPress SAML SSO Premium Multisite < 20.0.7 - Open Redirect in SSO login
Slug
miniorange-saml-20-single-sign-on
Published
2023-09-05
Title
SAML SP Single Sign On < 5.0.5 - Missing Authorization to notice dismissal
Slug
miniorange-sms-order-notification-otp-verification
Published
2026-01-09
Title
miniOrange OTP Verification and SMS Notification for WooCommerce < 4.3.9 - Missing Authorization to Unauthenticated Notification Settings Modification
Slug
miniorange-wp-as-saml-idp
Published
2022-06-06
Title
Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site Scripting
Slug
miniorange-wp-as-saml-idp
Published
2024-11-15
Title
Login using WordPress Users ( WP as SAML IDP ) < 1.15.7 - Authenticated (Administrator+) SQL Injection
Slug
mins-to-read
Published
2024-11-28
Title
Mins To Read <= 1.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
minterpress
Published
2024-12-11
Title
Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Slug
minterpress
Published
2025-01-16
Title
Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Slug
mipl-wc-multisite-sync
Published
2025-01-06
Title
MIPL WC Multisite Sync < 1.1.6 - Unauthenticated Arbitrary File Download
Slug
mipl-wc-multisite-sync
Published
2026-03-01
Title
MIPL WC Multisite Sync <= 1.4.4 - Missing Authorization
Slug
miraculous-el
Published
2026-02-10
Title
Miraculous Elementor < 2.0.8 - Authenticated (Subscriber+) Privilege Escalation
Slug
miraculouscore
Published
2025-08-21
Title
Miraculous Core < 2.0.8 - Unauthenticated Privilege Escalation
Slug
miraculouscore
Published
2025-09-01
Title
Miraculous Core < 2.0.9 - Unauthenticated Insecure Direct Object Reference
Slug
miraculouscore
Published
2026-03-20
Title
Miraculous Core < 2.1.2 - Authenticated (Subscriber+) SQL Injection
Slug
misiek-paypal
Published
2024-08-22
Title
Misiek Paypal <= 1.1.20090324 - Stored XSS via CSRF
Slug
misiek-photo-album
Published
2024-08-22
Title
Misiek Photo Album <= 1.4.3 - Stored XSS via CSRF
Slug
misiek-photo-album
Published
2024-08-22
Title
Misiek Photo Album <= 1.4.3 - Album Deletion via CSRF
Slug
mislider
Published
2025-10-23
Title
Multi Item Responsive Slider <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
missing-widgets-for-elementor
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
missing-widgets-for-elementor
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
mitfahrgelegenheit
Published
2025-09-10
Title
Mitfahrgelegenheit <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter
Slug
mitm-bug-tracker
Published
2024-10-14
Title
Mitm Bug Tracker <= 1.0 - Reflected Cross-Site Scripting