Unknown Google Authenticator vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Google Authenticator, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.6CVE-2022-0875miniorangegoogle_authenticator+2
EPSS score
0.43%
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks6.5CVE-2026-14204unknowngoogle authenticator+1
EPSS score
0.18%
The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.