Miniorange
32 CVEs across 57 Miniorange products. Browse Miniorange vulnerabilities, severities, and proof-of-concept exploits.
Miniorange products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61979 | High | 8.1 | 2026-08-13 | Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. |
CVE-2026-61967 | Critical | 9.8 | 2026-08-13 | Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. |
CVE-2026-28149 | Critical | 9.8 | 2026-08-13 | Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. |
CVE-2026-28148 | Critical | 9.8 | 2026-08-13 | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. |
CVE-2026-28008 | Critical | 9.8 | 2026-08-13 | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. |
CVE-2026-65520 | Critical | 9.3 | 2026-08-06 | Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. |
CVE-2026-61957 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. |
CVE-2026-65561 | Medium | 6.5 | 2026-07-27 | Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions. |
CVE-2026-59545 | High | 8.1 | 2026-07-23 | Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. |
CVE-2026-5343 | High | 7.4 | 2026-05-28 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML… |
CVE-2026-42731 | Critical | 9.8 | 2026-05-27 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affec… |
CVE-2021-47979 | High | 8.8 | 2026-05-16 | WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating… |
CVE-2026-3217 | Medium | 6.1 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scri… |
CVE-2025-68974 | Medium | 6.6 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and… |
CVE-2025-54745 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured… |
CVE-2025-54049 | Critical | 9.9 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP… |
CVE-2025-54048 | Critical | 9.3 | 2025-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL… |
CVE-2025-53561 | Medium | 6.5 | 2025-08-20 | Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent fil… |
CVE-2025-6675 | Medium | 4.8 | 2025-06-26 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-31019 | High | 8.8 | 2025-06-09 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abus… |
CVE-2025-47672 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange miniOrange Discord Integrat… |
CVE-2025-47670 | High | 8.1 | 2025-05-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and… |
CVE-2025-47710 | High | 7.4 | 2025-05-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-47709 | Medium | 6.5 | 2025-05-14 | Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from… |
CVE-2025-47708 | High | 8.8 | 2025-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA -… |
CVE-2025-47707 | High | 7.5 | 2025-05-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-47706 | Medium | 4.8 | 2025-05-14 | Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affec… |
CVE-2025-39545 | Medium | 5.4 | 2025-04-16 | Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access… |
CVE-2024-11087 | High | 8.1 | 2025-03-08 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all vers… |
CVE-2024-13301 | Medium | 6.1 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth… |
CVE-2024-11297 | Medium | 5.3 | 2024-12-20 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2023-41873 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2023-37987 | Medium | 6.5 | 2024-12-13 | Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2023-47776 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Contr… |
CVE-2023-25455 | Medium | 5.3 | 2024-12-09 | Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Config… |
CVE-2023-24375 | Low | 3.5 | 2024-12-09 | Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Config… |
CVE-2024-9862 | Critical | 9.8 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. Thi… |
CVE-2024-9861 | High | 8.1 | 2024-10-17 | The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due… |
CVE-2022-4539 | Medium | 5.3 | 2024-08-31 | The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient res… |
CVE-2023-52176 | Medium | 5.3 | 2024-06-04 | Authentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2023-47683 | High | 8.0 | 2024-05-17 | Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation… |
CVE-2024-0681 | Medium | 5.3 | 2024-03-13 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including… |
CVE-2024-25902 | High | 7.6 | 2024-02-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Sca… |
CVE-2023-6036 | Critical | 9.8 | 2024-02-12 | The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handl… |
CVE-2023-4757 | Medium | 5.4 | 2024-01-16 | The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server befo… |
CVE-2022-44589 | High | 8.1 | 2023-12-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication… |
CVE-2022-4943 | High | 7.5 | 2023-10-20 | The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin setting… |
CVE-2023-5003 | High | 7.5 | 2023-10-16 | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to e… |
CVE-2023-4506 | Low | 2.2 | 2023-09-27 | The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due t… |
CVE-2023-4505 | Low | 2.2 | 2023-09-27 | The Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This… |
CVE-2023-4238 | High | 7.2 | 2023-09-25 | The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files… |
CVE-2023-37986 | Medium | 5.9 | 2023-09-01 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange YourMembership Single Sign On – YM SSO Login plugin <= 1.1.3 versions. |
CVE-2022-34155 | High | 8.8 | 2023-07-18 | Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Sing… |
CVE-2023-3249 | Critical | 9.8 | 2023-06-30 | The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is… |
CVE-2023-3447 | High | 7.6 | 2023-06-29 | The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due t… |
CVE-2023-2982 | Critical | 9.8 | 2023-06-29 | The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and… |
CVE-2023-2599 | Low | 3.1 | 2023-06-09 | The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order… |
CVE-2023-2484 | High | 7.2 | 2023-06-09 | The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and inc… |
CVE-2023-23706 | Medium | 4.3 | 2023-05-23 | Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 version… |
CVE-2023-0812 | High | 7.5 | 2023-05-15 | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, le… |
CVE-2023-23710 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <=… |
CVE-2023-1093 | Medium | 6.5 | 2023-03-27 | The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make… |
CVE-2023-1092 | Medium | 6.5 | 2023-03-27 | The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPr… |
CVE-2022-4496 | Medium | 6.1 | 2023-01-30 | The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multis… |
CVE-2023-23749 | High | 7.5 | 2023-01-17 | The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing th… |
CVE-2022-4200 | Medium | 4.8 | 2023-01-02 | The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2022-45073 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress. |
CVE-2022-42461 | Medium | 5.4 | 2022-11-18 | Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress. |
CVE-2022-3082 | Medium | 6.5 | 2022-10-17 | The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users… |
CVE-2022-34858 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress. |
CVE-2022-34149 | Critical | 9.8 | 2022-08-22 | Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. |
CVE-2022-2133 | Medium | 5.3 | 2022-07-17 | The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto th… |
CVE-2022-1995 | Medium | 4.8 | 2022-06-27 | The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges t… |
CVE-2022-1994 | Medium | 4.8 | 2022-06-27 | The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users… |
CVE-2022-1321 | Medium | 4.8 | 2022-06-27 | The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administ… |
CVE-2022-1029 | Medium | 4.8 | 2022-06-27 | The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privil… |
CVE-2022-1028 | Medium | 4.8 | 2022-06-27 | The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to mal… |
CVE-2022-1010 | Medium | 4.8 | 2022-06-27 | The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high pri… |
CVE-2022-0875 | Medium | 4.3 | 2022-06-27 | The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowin… |
CVE-2022-0229 | High | 8.1 | 2022-03-21 | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and d… |
CVE-2021-36786 | High | 7.5 | 2021-08-13 | The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys. |
CVE-2021-36785 | Medium | 5.4 | 2021-08-13 | The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS. |
CVE-2020-6850 | Medium | 6.1 | 2020-02-17 | Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is r… |
CVE-2019-12346 | Medium | 6.1 | 2019-06-24 | In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse… |