Skip to content
OpenAdvisories

Vendor

miniOrange

52 known vulnerabilities.

Products

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) 5 WordPress Social Login and Register 5 miniorange otp verification 5 OAuth Single Sign On – SSO (OAuth Client) 4 Headless Single Sign On 3 SAML SP Single Sign On 3 miniOrange Discord Integration 2 Prevent files / folders access 2 Malware Scanner 2 WP OAuth Server 2 Custom API for WP 2 Page Restriction WordPress (WP) 2 Backup and Restore 1 miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login 1 YourMembership Single Sign On – YM SSO Login 1 WordPress REST API Authentication (WordPress plugin) 1 OAuth Single Sign On Free 1 OAuth Single Sign On Standard 1 OAuth Single Sign On Premium 1 OAuth Single Sign On Enterprise 1 JWT Authentication for WP REST APIs 1 miniOrange WordPress SAML SSO Standard 1 miniOrange WordPress SAML SSO Premium 1 miniOrange WordPress SAML SSO Premium MulsiteSite 1 WP OAuth Server (WordPress plugin) 1 OAuth 2.0 client for SSO (WordPress plugin) 1 Password Policy Manager 1 WordPress REST API Authentication 1 miniOrange's Google Authenticator 1 LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login 1 miniOrange's Google Authenticator (WordPress plugin) 1 YourMembership Single Sign On 1
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • High 7.5
    CVE-2026-62126

    WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability

    Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0.

    miniOrange SAML SP Single Sign On
  • High 7.1
    CVE-2026-82229

    WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

    miniOrange WordPress Social Login and Register Web / CMS
  • High 7.1
    CVE-2026-73351

    WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

    miniOrange WordPress Social Login and Register Web / CMS
  • High 8.1
    CVE-2026-61979

    WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

    miniOrange SAML SP Single Sign On
  • High 7.1
    CVE-2026-61957

    WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.

    miniOrange miniorange otp verification
  • High 8.1
    CVE-2026-59545

    WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

    miniOrange miniOrange Discord Integration
  • High 8.8
    CVE-2021-47979

    WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion

    WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_n…

    miniOrange Backup and Restore Web / CMS
  • High 8.8
    CVE-2025-31019

    WordPress Password Policy Manager plugin <= 2.0.4 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through <= 2.0.4.

    miniOrange Password Policy Manager
  • High 8.1
    CVE-2025-47670

    WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social…

    miniOrange WordPress Social Login and Register Web / CMS
  • High 8.1
    CVE-2025-47672

    WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange miniOrange Discord Integration miniorange-discord-integration allows PHP Local File Inclusion.This issue affects miniOrange Dis…

    miniOrange miniOrange Discord Integration
  • High 8.0
    CVE-2023-47683

    WordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerability

    Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/…

    miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • High 7.6
    CVE-2024-25902

    WordPress Malware Scanner Plugin <= 4.7.2 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Scanner: from n/a through 4.7.2.

    miniOrange Malware Scanner
  • High 8.1
    CVE-2022-44589

    WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Au…

    miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login Web / CMS
  • High 8.8
    CVE-2022-34155 Public exploit

    WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication

    Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.

    miniOrange OAuth Single Sign On – SSO (OAuth Client)
  • High 7.5
    CVE-2023-23749

    Extension - miniorange - LDAP Integration - LDAP Injection (username)

    The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents for…

    miniOrange LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login