Miniorange vulnerabilities, page 3
93 vulnerabilities
Known vulnerabilities in Miniorange products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 54 products.
CVE-2022-34155miniorangeoauth_single_sign_on+2
EPSS score0.96%
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.CVE-2024-13301drupaloauth & openid connect single sign on – sso (oauth/oidc client)+1EPSS score0.25%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19.CVE-2024-11297cyberlord92page and post restriction+2EPSS score0.61%
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.CVE-2024-11087cyberlord92miniorange social login and register (discord, google, twitter, linkedin)+2EPSS score0.47%
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.CVE-2024-0681cyberlord92page and post restriction+2EPSS score0.61%
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.3.4. This is due to the plugin not properly restricting access to pages via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected pages. The vendor has decided that they will not implement REST API protection on posts and pages and the restrictions will only apply to the front-end of the site. The vendors solution was to add notices throughout the dashboard and recommends installing the WordPress REST API Authentication plugin for REST API coverage.CVE-2024-9861cyberlord92miniorange otp verification with firebase+2EPSS score0.63%
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user.CVE-2024-9862cyberlord92miniorange otp verification with firebase+2EPSS score0.60%
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.CVE-2024-25902miniorangemalware_scanner+1EPSS score0.54%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Scanner: from n/a through 4.7.2.CVE-2019-12346miniorangesaml_sp_single_sign_on+1EPSS score1.07%
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.CVE-2026-73351miniorangewordpress social login and register+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.CVE-2026-61967miniorangeminiorange otp verification+1EPSS score0.48%
Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.CVE-2026-61957miniorangeminiorange otp verification+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.CVE-2026-61979miniorangesaml_sp_single_sign_on+1EPSS score0.42%
Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.CVE-2026-59545miniorangeminiorange discord integration+1EPSS score0.46%
Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.CVE-2026-65561miniorangewordpress social login and register+1EPSS score0.22%
Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.CVE-2026-65520miniorangewp oauth server+1EPSS score0.40%
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.CVE-2026-62108miniorangeheadless single sign on+1EPSS score0.61%
Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.CVE-2026-42731miniorangeminiorange otp verification+1EPSS score0.48%
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9.CVE-2026-89027miniorangejwt authentication for wp rest apis+1EPSS score0.38%
miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.CVE-2026-106610miniorangeminiorange otp verification+1EPSS score0.48%
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.