Skip to content
OpenAdvisories

Vendor

miniOrange

52 known vulnerabilities.

Products

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) 5 WordPress Social Login and Register 5 miniorange otp verification 5 OAuth Single Sign On – SSO (OAuth Client) 4 Headless Single Sign On 3 SAML SP Single Sign On 3 miniOrange Discord Integration 2 Prevent files / folders access 2 Malware Scanner 2 WP OAuth Server 2 Custom API for WP 2 Page Restriction WordPress (WP) 2 Backup and Restore 1 miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login 1 YourMembership Single Sign On – YM SSO Login 1 WordPress REST API Authentication (WordPress plugin) 1 OAuth Single Sign On Free 1 OAuth Single Sign On Standard 1 OAuth Single Sign On Premium 1 OAuth Single Sign On Enterprise 1 JWT Authentication for WP REST APIs 1 miniOrange WordPress SAML SSO Standard 1 miniOrange WordPress SAML SSO Premium 1 miniOrange WordPress SAML SSO Premium MulsiteSite 1 WP OAuth Server (WordPress plugin) 1 OAuth 2.0 client for SSO (WordPress plugin) 1 Password Policy Manager 1 WordPress REST API Authentication 1 miniOrange's Google Authenticator 1 LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login 1 miniOrange's Google Authenticator (WordPress plugin) 1 YourMembership Single Sign On 1
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-54852

    WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1.

    miniOrange Page Restriction WordPress (WP) Web / CMS
  • Medium 5.3
    CVE-2026-114696

    WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.0.

    miniOrange Page Restriction WordPress (WP) Web / CMS
  • Medium 6.5
    CVE-2026-107433

    WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.

    miniOrange WP OAuth Server
  • Medium 4.3
    CVE-2026-97267

    WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

    miniOrange Prevent files / folders access
  • Medium 6.5
    CVE-2026-89027

    miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

    miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET para…

    miniOrange JWT Authentication for WP REST APIs Web / CMS
  • Medium 6.5
    CVE-2026-65561

    WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

    miniOrange WordPress Social Login and Register Web / CMS
  • Medium 6.6
    CVE-2025-68974

    WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social…

    miniOrange WordPress Social Login and Register Web / CMS
  • Medium 6.5
    CVE-2025-54745

    WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a throu…

    miniOrange miniOrange's Google Authenticator
  • Medium 6.5
    CVE-2025-53561

    WordPress Prevent files / folders access Plugin <= 2.6.0 - Path Traversal Vulnerability

    Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through <= 2.6.0.

    miniOrange Prevent files / folders access
  • Medium 5.4
    CVE-2025-39545

    WordPress REST API Authentication plugin <= 3.6.3 - Settings Change Vulnerability

    Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress REST API Authentication: from n/a through <= 3.…

    miniOrange WordPress REST API Authentication Web / CMS
  • Medium 4.3
    CVE-2023-41873

    WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.

    miniOrange SAML SP Single Sign On
  • Medium 6.5
    CVE-2023-37987

    WordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign On: from n/a through 1.1.3.

    miniOrange YourMembership Single Sign On
  • Medium 5.3
    CVE-2023-25455

    WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord,…

    miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • Medium 4.3
    CVE-2023-47776

    WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through <= 4.2.1.

    miniOrange miniorange otp verification
  • Medium 5.3
    CVE-2023-52176

    WordPress Malware Scanner plugin <= 4.7.1 - IP Restriction Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Malware Scanner: from n/a through 4.7.1.

    miniOrange Malware Scanner
  • Medium 5.9
    CVE-2023-37986

    WordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange YourMembership Single Sign On – YM SSO Login plugin <= 1.1.3 versions.

    miniOrange YourMembership Single Sign On – YM SSO Login
  • Medium 4.3
    CVE-2023-23706

    WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

    miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • Medium 5.9
    CVE-2023-23710

    WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

    miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • Medium 6.5
    CVE-2023-1092

    OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF

    The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not h…

    miniOrange OAuth Single Sign On Standard OAuth Single Sign On Enterprise OAuth Single Sign On Free Web / CMS
  • Medium 6.1
    CVE-2022-4496

    miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login

    The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to i…

    miniOrange miniOrange WordPress SAML SSO Standard miniOrange WordPress SAML SSO Premium MulsiteSite miniOrange WordPress SAML SSO Premium Web / CMS
  • Medium 5.4
    CVE-2022-45073

    WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.

    miniOrange WordPress REST API Authentication (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-42461

    WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

    Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

    miniOrange miniOrange's Google Authenticator (WordPress plugin) Web / CMS