WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
miniorange-2-factor-authentication
Published
2025-08-23
Title
miniOrange's Google Authenticator < 6.1.2 - Missing Authorization
Slug
miniorange-2-factor-authentication
Published
2026-07-15
Title
miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret
Slug
miniorange-2-factor-authentication
Published
2026-07-27
Title
miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send
Slug
miniorange-2-factor-authentication
Published
2026-07-29
Title
miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding
Slug
miniorange-2-factor-authentication
Published
2026-07-30
Title
miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts
Slug
miniorange-discord-integration
Published
2022-09-26
Title
miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling
Slug
miniorange-discord-integration
Published
2025-05-22
Title
miniOrange Discord Integration <= 2.2.2 - Unauthenticated Local File Inclusion
Slug
miniorange-discord-integration
Published
2026-07-22
Title
miniOrange Discord Integration < 2.2.5 - Missing Authorization
Slug
miniorange-firebase-sms-otp-verification
Published
2024-10-16
Title
Miniorange OTP Verification with Firebase < 3.6.1 - Unauthenticated Arbitrary User Password Change
Slug
miniorange-firebase-sms-otp-verification
Published
2024-10-16
Title
Miniorange OTP Verification with Firebase < 3.6.1 - Authentication Bypass
Slug
miniorange-firebase-sms-otp-verification
Published
2024-10-16
Title
Miniorange OTP Verification with Firebase < 3.6.1 - Privilege Escalation via Registration due to Administrator Default User Role Value
Slug
miniorange-firebase-sms-otp-verification
Published
2025-09-19
Title
Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation
Slug
miniorange-google-authenticator
Published
2022-06-06
Title
Google Authenticator < 1.0.8 - Admin+ Stored Cross-Site Scripting
Slug
miniorange-google-authenticator
Published
2022-06-06
Title
miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting
Slug
miniorange-limit-login-attempts
Published
2021-08-23
Title
Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting
Slug
miniorange-limit-login-attempts
Published
2022-06-06
Title
Limit Login Attempts < 4.0.72 - Admin+ Stored Cross-Site Scripting
Slug
miniorange-login-openid
Published
2023-02-15
Title
WordPress Social Login and Register < 7.6.0 - Admin+ Stored XSS
Slug
miniorange-login-openid
Published
2023-02-13
Title
WordPress Social Login and Register < 7.6.1 - Unauthenticated Arbitrary Content Deletion
Slug
miniorange-login-openid
Published
2023-02-15
Title
WordPress Social Login and Register < 7.5.15 - Multiple CSRF
Slug
miniorange-login-openid
Published
2023-06-28
Title
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.6.5 - Authentication Bypass
Slug
miniorange-login-openid
Published
2023-11-09
Title
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.6.7 - Authenticated (Subscriber+) Privilege Escalation
Slug
miniorange-login-openid
Published
2025-03-07
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon < 200.3.10 - Authentication Bypass
Slug
miniorange-login-openid
Published
2025-05-21
Title
WordPress Social Login and Register < 7.7.0 - Unauthenticated Local File Inclusion
Slug
miniorange-login-openid
Published
2025-09-28
Title
Social Login and Register <= 7.7.0 - Authenticated (Administrator+) Local File Inclusion
Slug
miniorange-login-openid
Published
2026-07-08
Title
miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover