WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
miniorange-login-openid
Published
2026-07-10
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow
Slug
miniorange-login-openid
Published
2026-07-24
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
miniorange-login-openid
Published
2026-08-18
Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.2 - Unauthenticated Stored Cross-Site Scripting
Slug
miniorange-login-openid
Published
2026-08-28
Title
Social Login, Social Sharing by miniOrange < 7.9.0 - Unauthenticated Stored Cross-Site Scripting
Slug
miniorange-login-security
Published
2021-08-10
Title
Two Factor Authentication < 1.0.8 - Reflected Cross-Site Scripting
Slug
miniorange-login-with-eve-online-google-facebook
Published
2021-08-30
Title
Multiple Plugins from miniorange - Reflected Cross-Site Scripting via appId
Slug
miniorange-login-with-eve-online-google-facebook
Published
2022-06-27
Title
OAuth Single Sign On < 6.22.6 - Authentication Bypass
Slug
miniorange-login-with-eve-online-google-facebook
Published
2023-02-28
Title
OAuth Single Sign On - SSO (OAuth Client) Free < 6.24.2 - IdP Deletion via CSRF
Slug
miniorange-login-with-eve-online-google-facebook
Published
2023-02-28
Title
OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF
Slug
miniorange-login-with-eve-online-google-facebook
Published
2023-07-18
Title
OAuth Single Sign On – SSO (OAuth Client) < 6.23.4 - Improper Authentication
Slug
miniorange-login-with-eve-online-google-facebook
Published
2024-12-11
Title
OAuth Single Sign On – SSO (OAuth Client) < 6.26.4 - Authentication Bypass
Slug
miniorange-login-with-eve-online-google-facebook
Published
2025-09-25
Title
OAuth Single Sign On – SSO (OAuth Client) < 6.26.13 - Cross-Site Request Forgery
Slug
miniorange-login-with-eve-online-google-facebook
Published
2025-10-03
Title
OAuth Single Sign On < 6.26.13 - Authentication Bypass
Slug
miniorange-login-with-eve-online-google-facebook
Published
2026-02-05
Title
OAuth Single Sign On – SSO (OAuth Client) < 6.26.15 - Missing Authorization
Slug
miniorange-login-with-eve-online-google-facebook
Published
2026-08-31
Title
OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion
Slug
miniorange-malware-protection
Published
2022-06-06
Title
miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting
Slug
miniorange-malware-protection
Published
2023-12-29
Title
Malware Scanner < 4.7.2 - IP Spoofing
Slug
miniorange-malware-protection
Published
2024-02-12
Title
Malware Scanner < 4.7.3 - Admin+ SQLi
Slug
miniorange-malware-protection
Published
2024-03-13
Title
Malware Scanner < 4.7.3 and Web Application Firewall < 2.1.2 - Unauthenticated Privilege Escalation
Slug
miniorange-oauth-20-server
Published
2022-06-20
Title
WP OAuth Server ( Login with WordPress ) < 4.0.1 - Authentication Bypass
Slug
miniorange-oauth-20-server
Published
2026-07-28
Title
WP OAuth Server ( Login with WordPress ) < 6.2.1 - Unauthenticated SQL Injection
Slug
miniorange-oauth-20-server
Published
2026-08-25
Title
WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
Slug
miniorange-oauth-oidc-single-sign-on
Published
2023-02-28
Title
OAuth Single Sign On - SSO (OAuth Client) Enterprise < 48.4.9 - IdP Deletion via CSRF
Slug
miniorange-oauth-oidc-single-sign-on
Published
2023-02-28
Title
OAuth Single Sign On - SSO (OAuth Client) Premium < 38.4.9 - IdP Deletion via CSRF
Slug
miniorange-oauth-oidc-single-sign-on
Published
2023-02-28
Title
OAuth Single Sign On - SSO (OAuth Client) Standard < 28.4.9 - IdP Deletion via CSRF