CveMateVulnerability intelligence

Cyberlord92 vulnerabilities

45 vulnerabilities

Known vulnerabilities in Cyberlord92 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 30 products.

Products

30

Active Directory Integration / LDAP Integration4 vulnerabilities
Miniorange OTP Verification With Firebase4 vulnerabilities
Oauth Single Sign On – SSO (Oauth Client)4 vulnerabilities
Miniorange OTP Login, Verification And SMS Notifications3 vulnerabilities
Miniorange Social Login And Register (Discord, Google, Twitter, Linkedin)3 vulnerabilities
Page And Post Restriction3 vulnerabilities
SAML Single Sign On – SSO Login3 vulnerabilities
Broken Link Checker | Finder2 vulnerabilities
Employee Directory – Staff Directory And Listing2 vulnerabilities
Integrate Dynamics 365 CRM2 vulnerabilities
Powerbi Embed Reports2 vulnerabilities
Web Application Firewall – Website Security2 vulnerabilities
All In One Microsoft 365 & Entra ID / Azure AD SSO Login1 vulnerabilities
Login With Yourmembership – YM SSO Login1 vulnerabilities
Malware Scanner1 vulnerabilities
Miniorange 2FA – Two Factor Authentication For Wordpress (Sms, Email & Google Authenticator)1 vulnerabilities
Miniorange OTP Verification And SMS Notification For Woocommerce1 vulnerabilities
Password Policy Manager | Password Manager1 vulnerabilities
SAML IDP (Identity Provider) – Login With Website Users1 vulnerabilities
Staff/Employee Business Directory For Active Directory1 vulnerabilities
User Sync1 vulnerabilities
Web3 – Crypto Wallet Login & NFT Token Gating1 vulnerabilities
Wordpress Single Sign On (Sso) Multisite All Inclusive1 vulnerabilities
Wordpress Single Sign On (Sso) Multisite Enterprise1 vulnerabilities
Wordpress Single Sign On (Sso) Multisite Premium1 vulnerabilities
Wordpress Single Sign On (Sso) Single Site All Inclusive1 vulnerabilities
Wordpress Single Sign On (Sso) Single Site Enterprise1 vulnerabilities
Wordpress Single Sign On (Sso) Single Site Premium1 vulnerabilities
Wordpress Single Sign On (Sso) Single Site Standard1 vulnerabilities
WP Login And Register Using JWT1 vulnerabilities

CVE-2026-103895cyberlord92miniorange otp login, verification and sms notifications5d ago16-10-2026 04:26

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.CVE-2025-11255cyberlord92password policy manager | password manager+112mo ago25-10-2025 06:49

The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to, and including, 2.0.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log out the site's connection to miniorange.CVE-2025-9891cyberlord92user sync+11y ago17-09-2025 01:53

The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the mo_user_sync_form_handler() function. This makes it possible for unauthenticated attackers to deactivate the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2025-9485cyberlord92oauth single sign on – sso (oauth client)+11y ago04-10-2025 02:24

The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.CVE-2025-14948cyberlord92miniorange otp verification and sms notification for woocommerce+19mo ago10-01-2026 07:03

The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `enable_wc_sms_notification` AJAX action in all versions up to, and including, 4.3.8. This makes it possible for unauthenticated attackers to enable or disable SMS notification settings for WooCommerce orders.CVE-2025-7665cyberlord92miniorange otp verification with firebase+11y ago19-09-2025 12:27

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofirebase_form_options' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to Administrator. Premium features must be enabled in order to exploit the vulnerability.CVE-2025-10750cyberlord92powerbi embed reports+11y ago18-10-2025 07:26

The PowerBI Embed Reports plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.2.0. This is due to missing capability checks and authentication verification on the 'testUser' endpoint accessible via the mo_epbr_admin_observer() function hooked on 'init'. This makes it possible for unauthenticated attackers to access sensitive Azure AD user information including personal identifiable information (PII) such as displayName, mail, phones, department, or detailed OAuth error data including Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs.CVE-2025-10753cyberlord92oauth single sign on – sso (oauth client)+18mo ago06-02-2026 06:46

The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality accessible via the 'oauthredirect' option parameter. This makes it possible for unauthenticated attackers to set the global redirect URL option via the redirect_url parameter granted they can access the site directly.CVE-2025-10648cyberlord92login with yourmembership – ym sso login+11y ago15-10-2025 08:25

The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login.CVE-2025-10752cyberlord92oauth single sign on – sso (oauth client)+11y ago26-09-2025 01:47

The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2025-10746cyberlord92integrate dynamics 365 crm+11y ago04-10-2025 02:24

The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters.CVE-2025-6003cyberlord92wordpress single sign-on (sso) - multisite all-inclusive+71y ago12-06-2025 08:22

The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.CVE-2025-12822cyberlord92wp login and register using jwt+111mo ago19-11-2025 05:45

The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mo_jwt_generate_new_api_key' function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate a new API key on site's that do not have an API key configured and subsequently use that to access restricted endpoints.CVE-2025-8420cyberlord92employee directory – staff directory and listing+151y ago06-08-2025 02:24

Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called CVE-2022-4539cyberlord92web application firewall – website security+22y ago31-08-2024 09:35

The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.CVE-2022-4943cyberlord92miniorange 2fa – two-factor authentication for wordpress (sms, email & google authenticator)+23y ago20-10-2023 07:29

The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings.CVE-2024-2172cyberlord92malware scanner+32y ago13-03-2024 15:26

The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator.CVE-2024-11901cyberlord92powerbi embed reports+11y ago12-12-2024 03:23

The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MO_API_POWER_BI' shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-11297cyberlord92page and post restriction+21y ago20-12-2024 06:59

The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.CVE-2024-11087cyberlord92miniorange social login and register (discord, google, twitter, linkedin)+21y ago08-03-2025 07:04

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.