Skip to content
OpenAdvisories

Vendor

cyberlord92

46 known vulnerabilities.

Products

Active Directory Integration / LDAP Integration 4 OAuth Single Sign On – SSO (OAuth Client) 4 Miniorange OTP Verification with Firebase 4 Page and Post Restriction 4 miniOrange OTP Login, Verification and SMS Notifications 3 SAML Single Sign On – SSO Login 3 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) 3 Employee Directory – Staff Directory and Listing 2 Integrate Dynamics 365 CRM 2 Web Application Firewall – website security 2 PowerBI Embed Reports 2 Broken Link Checker | Finder 2 miniOrange OTP Verification and SMS Notification for WooCommerce 1 Login with YourMembership – YM SSO Login 1 SAML IDP (Identity Provider) – Login with Website Users 1 miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator) 1 All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login 1 WP Login and Register using JWT 1 Password Policy Manager | Password Manager 1 User Sync 1 Malware Scanner 1 WordPress Single Sign-On (SSO) - Single Site Standard 1 WordPress Single Sign-On (SSO) - Single Site Premium 1 WordPress Single Sign-On (SSO) - Multisite Premium 1 WordPress Single Sign-On (SSO) - Single Site Enterprise 1 WordPress Single Sign-On (SSO) - Multisite Enterprise 1 WordPress Single Sign-On (SSO) - Single Site All-Inclusive 1 WordPress Single Sign-On (SSO) - Multisite All-Inclusive 1 Staff/Employee Business Directory for Active Directory 1 Web3 – Crypto wallet Login & NFT token gating 1
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-118194

    Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication

    The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the curren…

    cyberlord92 Page and Post Restriction Web / CMS
  • Medium 6.4
    CVE-2026-1279

    Employee Directory <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute

    The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_title' parameter in the `search_employee_directory` shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output …

    cyberlord92 Employee Directory – Staff Directory and Listing Web / CMS
  • Medium 5.3
    CVE-2025-10753

    OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorization

    The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality…

    cyberlord92 OAuth Single Sign On – SSO (OAuth Client) Web / CMS
  • Medium 4.4
    CVE-2026-0725

    Integrate Dynamics 365 CRM <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration

    The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes …

    cyberlord92 Integrate Dynamics 365 CRM Web / CMS
  • Medium 5.3
    CVE-2025-14948

    miniOrange OTP Verification and SMS Notification for WooCommerce <= 4.3.8 - Missing Authorization to Unauthenticated Notification Settings Modification

    The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `enable_wc_sms_notification` AJAX action in all versions up to, and including…

    cyberlord92 miniOrange OTP Verification and SMS Notification for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-12822

    WP Login and Register using JWT <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure

    The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mo_jwt_generate_new_api_key' function in all versions up to, and including, 3.0.0. This makes it possible for authe…

    cyberlord92 WP Login and Register using JWT Web / CMS
  • Medium 4.3
    CVE-2025-11255

    Password Policy Manager | Password Manager <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Out

    The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to, and including, 2.0.5. This makes it possible for …

    cyberlord92 Password Policy Manager | Password Manager Web / CMS
  • Medium 5.3
    CVE-2025-10750

    PowerBI Embed Reports <= 1.2.0 - Unauthenticated Sensitive Information Disclosure

    The PowerBI Embed Reports plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.2.0. This is due to missing capability checks and authentication verification on the 'testUser' endpoint accessible via th…

    cyberlord92 PowerBI Embed Reports Web / CMS
  • Medium 5.3
    CVE-2025-10648

    Login with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'

    The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it poss…

    cyberlord92 Login with YourMembership – YM SSO Login Web / CMS
  • Medium 6.5
    CVE-2025-10746

    Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization

    The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for una…

    cyberlord92 Integrate Dynamics 365 CRM Web / CMS
  • Medium 4.3
    CVE-2025-10752

    OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery

    The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness i…

    cyberlord92 OAuth Single Sign On – SSO (OAuth Client) Web / CMS
  • Medium 4.3
    CVE-2025-9891

    User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation

    The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the mo_user_sync_form_handler() function. This makes it poss…

    cyberlord92 User Sync Web / CMS
  • Medium 5.3
    CVE-2025-6003

    WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure

    The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticat…

    cyberlord92 WordPress Single Sign-On (SSO) - Single Site Standard WordPress Single Sign-On (SSO) - Multisite Premium WordPress Single Sign-On (SSO) - Multisite Enterprise Web / CMS
  • Medium 5.3
    CVE-2023-46082

    WordPress Broken Link Checker | Finder plugin <= 2.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cyberlord92 Broken Link Checker | Finder broken-link-finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Checker | Finder: from n/a through <= 2.4.2.

    cyberlord92 Broken Link Checker | Finder
  • Medium 5.3
    CVE-2024-11297

    Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

    The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated atta…

    cyberlord92 Page and Post Restriction Web / CMS
  • Medium 5.4
    CVE-2024-12121

    Broken Link Checker | Finder <= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery

    The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the 'moblc_check_link' function. This makes it possible for authenticated attackers, with Author-level acc…

    cyberlord92 Broken Link Checker | Finder Web / CMS
  • Medium 6.4
    CVE-2024-11901

    PowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MO_API_POWER_BI' shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied at…

    cyberlord92 PowerBI Embed Reports Web / CMS
  • Medium 5.3
    CVE-2022-4539 Public exploit

    Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass

    The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restr…

    cyberlord92 Web Application Firewall – website security Web / CMS
  • Medium 5.3
    CVE-2024-0681

    Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass

    The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.3.4. This is due to the plugin not properly restricting access to pages via the REST API when a pa…

    cyberlord92 Page and Post Restriction Web / CMS