cyberlord92

12 results · Clear filters · Feed

• High 8.1
  CVE-2026-103895

  miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

  The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting th…

  cyberlord92 miniOrange OTP Login, Verification and SMS Notifications Web / CMS
  Oct 16, 2026
• High 7.5
  CVE-2026-75807

  SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning

  The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLRe…

  cyberlord92 SAML Single Sign On – SSO Login Web / CMS
  Aug 29, 2026
• High 7.5
  CVE-2026-12000

  Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API

  The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/…

  cyberlord92 Page and Post Restriction Web / CMS
  Aug 5, 2026
• High 8.1
  CVE-2025-7665

  Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation

  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofirebase_form_options' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated …

  cyberlord92 Miniorange OTP Verification with Firebase Web / CMS
  Sep 19, 2025
• High 8.1
  CVE-2025-8420

  Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution

  Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input …

  cyberlord92 emarket-design Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress Simple Contact Form Plugin for WordPress – WP Easy Contact Web / CMS
  Aug 6, 2025
• High 8.1
  CVE-2024-11087

  miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass

  The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being retur…

  cyberlord92 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  Mar 8, 2025
• High 8.1
  CVE-2024-10111

  OAuth Single Sign On – SSO (OAuth Client) <= 6.26.3 - Authentication Bypass

  The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is due to insufficient verification on the user being returned by the social login token. This makes i…

  cyberlord92 OAuth Single Sign On – SSO (OAuth Client) Web / CMS
  Dec 12, 2024
• High 7.2
  CVE-2024-9887

  Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection

  The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of suffi…

  cyberlord92 SAML IDP (Identity Provider) – Login with Website Users Web / CMS
  Nov 16, 2024
• High 8.1
  CVE-2024-9861

  Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass

  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This make…

  cyberlord92 Miniorange OTP Verification with Firebase Web / CMS
  Oct 17, 2024
• High 7.5
  CVE-2022-4943

  miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change

  The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to c…

  cyberlord92 miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator) Web / CMS
  Oct 20, 2023
• High 7.6
  CVE-2023-3447

  Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection

  The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with a…

  cyberlord92 Active Directory Integration / LDAP Integration Web / CMS
  Jun 29, 2023
• High 7.2
  CVE-2023-2484

  Active Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL Injection

  The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient pre…

  cyberlord92 Active Directory Integration / LDAP Integration Web / CMS
  Jun 9, 2023