CVEs we hold for Miniorange
Records whose assigning authority named Miniorange as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-89027miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication DowngrademiniOrange JWT Authentication for WP REST APIs
CVE-2026-82229WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerabilityminiOrange WordPress Social Login and Register
CVE-2026-77998Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML…miniorange.com SAML SSO login with Google Apps extension…
CVE-2026-77995Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On…miniorange.com Single Sign-On for Educational Institutes…
CVE-2026-77771miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP LockoutUnknown miniOrange 2FA
CVE-2026-77770miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link ValidatorUnknown miniOrange 2FA
CVE-2026-73351WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerabilityminiOrange WordPress Social Login and Register
CVE-2026-65561WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerabilityminiOrange WordPress Social Login and Register
CVE-2026-65520WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerabilityminiOrange WP OAuth Server
CVE-2026-62108WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerabilityminiOrange Headless Single Sign On
CVE-2026-61979WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerabilityminiOrange SAML SP Single Sign On
CVE-2026-61967WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerabilityminiorange otp verification
CVE-2026-61957WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerabilityminiorange otp verification
CVE-2026-59545WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerabilityminiOrange Discord Integration
CVE-2026-57807WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerabilityminiOrange Security Software Pvt Ltd. OAuth Single Sign On…
CVE-2026-42731WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerabilityminiorange otp verification
CVE-2026-28149WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerabilityminiOrange Headless Single Sign On
CVE-2026-28148WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerabilityminiOrange Headless Single Sign On
CVE-2026-28008WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerabilityminiOrange OAuth Single Sign On – SSO (OAuth Client)
CVE-2026-16619miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor AttemptsUnknown miniOrange 2FA
CVE-2026-16036miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor RebindingUnknown miniOrange 2FA
CVE-2026-16035miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP SendUnknown miniOrange 2FA
CVE-2026-14300miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account TakeoverUnknown miniOrange Social Login and Register (Discord…
CVE-2026-12695miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secretUnknown miniOrange 2FA
CVE-2025-68974WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerabilityminiOrange WordPress Social Login and Register
CVE-2025-54745WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control VulnerabilityminiOrange miniOrange's Google Authenticator
CVE-2025-54049WordPress Custom API for WP <= 4.2.2 - Privilege Escalation VulnerabilityminiOrange Custom API for WP
CVE-2025-54048WordPress Custom API for WP <= 4.2.2 - SQL Injection VulnerabilityminiOrange Custom API for WP
CVE-2025-53561WordPress Prevent files / folders access Plugin <= 2.6.0 - Path Traversal VulnerabilityminiOrange Prevent files / folders access
CVE-2025-47672WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion VulnerabilityminiOrange Discord Integration
CVE-2025-47670WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion VulnerabilityminiOrange WordPress Social Login and Register
CVE-2025-39545WordPress REST API Authentication plugin <= 3.6.3 - Settings Change VulnerabilityminiOrange WordPress REST API Authentication
CVE-2025-31019WordPress Password Policy Manager plugin <= 2.0.4 - Account Takeover vulnerabilityminiOrange Password Policy Manager
CVE-2024-25902WordPress Malware Scanner Plugin <= 4.7.2 is vulnerable to SQL Injectionminiorange Malware Scanner
CVE-2023-52176WordPress Malware Scanner plugin <= 4.7.1 - IP Restriction Bypass vulnerabilityminiorange Malware Scanner
CVE-2023-47776WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerabilityminiorange otp verification
CVE-2023-47683WordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerabilityminiOrange WordPress Social Login and Register (Discord…
CVE-2023-41873WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerabilityminiOrange SAML SP Single Sign On
CVE-2023-37987WordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerabilityminiOrange YourMembership Single Sign On
CVE-2023-37986WordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)miniOrange YourMembership Single Sign On – YM SSO Login
CVE-2023-25455WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content…miniOrange WordPress Social Login and Register (Discord…
CVE-2023-24375WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access…miniOrange WordPress Social Login and Register (Discord…
CVE-2023-23749Extension - miniorange - LDAP Integration - LDAP Injection (username)miniorange LDAP Integration with Active Directory and…
CVE-2023-23710WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to…miniOrange WordPress Social Login and Register (Discord…
CVE-2023-23706WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to…miniOrange WordPress Social Login and Register (Discord…
CVE-2023-1092OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRFMiniOrange OAuth Single Sign On Enterprise
CVE-2022-45073WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerabilityminiOrange WordPress REST API Authentication (WordPress…
CVE-2022-4496miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO loginminiOrange WordPress SAML SSO Premium MulsiteSite
CVE-2022-44589WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data ExposureminiOrange miniOrange's Google Authenticator – WordPress…
CVE-2022-42461WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerabilityminiOrange miniOrange's Google Authenticator (WordPress…
CVE-2022-34858WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerabilityminiOrange OAuth 2.0 client for SSO (WordPress plugin)
CVE-2022-34155WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken AuthenticationminiOrange OAuth Single Sign On – SSO (OAuth Client)
CVE-2022-34149WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerabilityminiOrange WP OAuth Server (WordPress plugin)
CVE-2022-3082miniOrange Discord Integration < 2.1.6 - Subscriber+ App DisablingUnknown miniOrange Discord Integration
CVE-2022-1321miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site ScriptingUnknown miniOrange's Google Authenticator – WordPress Two…
CVE-2022-0229miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options DeletionUnknown miniOrange's Google Authenticator
CVE-2021-47979WordPress Plugin Backup and Restore 1.0.3 Arbitrary File DeletionMiniorange Backup and Restore
57 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.