WordPress Plugin Vulnerabilities

Two Factor Authentication < 1.0.8 - Reflected Cross-Site Scripting

Description

The plugin does not escape the user parameter before outputting it back in an attribute in the dashboard page to confirm the 2FA reset, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
miniorange-login-security
Fixed in 1.0.8

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
a981aaf1-ff0b-4d31-8951-5faa9580ee90

Timeline

Publicly Published
2021-08-10 (about 4 years ago)
Added
2021-08-10 (about 4 years ago)
Last Updated
2021-08-10 (about 4 years ago)

Other

Published
Title
Published
2025-03-23
Title
Custom Smilies <= 2.9.2 - Reflected Cross-Site Scripting
Published
2024-07-29
Title
Hustle < 7.8.5 - Admin+ Stored XSS
Published
2021-04-13
Title
Elementor Addon Elements < 1.11.2 - Contributor+ Stored XSS
Published
2024-05-02
Title
Pet Manager <= 1.4 - Reflected XSS
Published
2025-02-18
Title
XV Random Quotes <= 2.6.0 - Reflected XSS