Skip to content
OpenAdvisories

Vendor

miniOrange

52 known vulnerabilities.

Products

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) 5 WordPress Social Login and Register 5 miniorange otp verification 5 OAuth Single Sign On – SSO (OAuth Client) 4 Headless Single Sign On 3 SAML SP Single Sign On 3 miniOrange Discord Integration 2 Prevent files / folders access 2 Malware Scanner 2 WP OAuth Server 2 Custom API for WP 2 Page Restriction WordPress (WP) 2 Backup and Restore 1 miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login 1 YourMembership Single Sign On – YM SSO Login 1 WordPress REST API Authentication (WordPress plugin) 1 OAuth Single Sign On Free 1 OAuth Single Sign On Standard 1 OAuth Single Sign On Premium 1 OAuth Single Sign On Enterprise 1 JWT Authentication for WP REST APIs 1 miniOrange WordPress SAML SSO Standard 1 miniOrange WordPress SAML SSO Premium 1 miniOrange WordPress SAML SSO Premium MulsiteSite 1 WP OAuth Server (WordPress plugin) 1 OAuth 2.0 client for SSO (WordPress plugin) 1 Password Policy Manager 1 WordPress REST API Authentication 1 miniOrange's Google Authenticator 1 LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login 1 miniOrange's Google Authenticator (WordPress plugin) 1 YourMembership Single Sign On 1
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-120844

    WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.…

    miniOrange OAuth Single Sign On – SSO (OAuth Client)
  • Critical 9.8
    CVE-2026-106610 Public exploit

    WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

    miniOrange miniorange otp verification
  • Critical 9.8
    CVE-2026-97274

    WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

    miniOrange OAuth Single Sign On – SSO (OAuth Client)
  • Critical 9.8
    CVE-2026-62108

    WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.

    miniOrange Headless Single Sign On
  • Critical 9.8
    CVE-2026-61967

    WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

    miniOrange miniorange otp verification
  • Critical 9.8
    CVE-2026-28149

    WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

    miniOrange Headless Single Sign On
  • Critical 9.8
    CVE-2026-28148

    WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

    miniOrange Headless Single Sign On
  • Critical 9.8
    CVE-2026-28008

    WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

    miniOrange OAuth Single Sign On – SSO (OAuth Client)
  • Critical 9.3
    CVE-2026-65520

    WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

    miniOrange WP OAuth Server
  • Critical 9.8
    CVE-2026-42731

    WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9.

    miniOrange miniorange otp verification
  • Critical 9.3
    CVE-2025-54048

    WordPress Custom API for WP <= 4.2.2 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2.

    miniOrange Custom API for WP
  • Critical 9.9
    CVE-2025-54049

    WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2.

    miniOrange Custom API for WP
  • Critical 9.8
    CVE-2022-34149

    WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability

    Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.

    miniOrange WP OAuth Server (WordPress plugin) Web / CMS
  • Critical 9.8
    CVE-2022-34858

    WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability

    Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.

    miniOrange OAuth 2.0 client for SSO (WordPress plugin) Web / CMS