# cve.now: Miniorange

The newest entries naming Miniorange as an affected vendor (up to 200), of 52 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120844](https://cve.now/CVE-2026-120844.md): WordPress OAuth Single Sign On – SSO (OAuth Client) plugin \<= 7.1.3 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-62126](https://cve.now/CVE-2026-62126.md): WordPress SAML SP Single Sign On plugin \<= 6.1.0 - Denial of Service Attack vulnerability (CVSS 7.5)
- [CVE-2026-54852](https://cve.now/CVE-2026-54852.md): WordPress Page Restriction WordPress (WP) plugin \<= 1.6.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-114696](https://cve.now/CVE-2026-114696.md): WordPress Page Restriction WordPress (WP) plugin \<= 1.6.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-107433](https://cve.now/CVE-2026-107433.md): WordPress WP OAuth Server plugin \<= 6.4.0 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-106610](https://cve.now/CVE-2026-106610.md): WordPress miniorange otp verification plugin \<= 5.5.7 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-97274](https://cve.now/CVE-2026-97274.md): WordPress OAuth Single Sign On – SSO (OAuth Client) plugin \<= 7.1.2 - Bypass vulnerability vulnerability (CVSS 9.8)
- [CVE-2026-97267](https://cve.now/CVE-2026-97267.md): WordPress Prevent files / folders access plugin \<= 2.6.7 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-62108](https://cve.now/CVE-2026-62108.md): WordPress Headless Single Sign On plugin \<= 1.7.0 - Broken Authentication vulnerability (CVSS 9.8)
- [CVE-2026-89027](https://cve.now/CVE-2026-89027.md): miniOrange JWT Authentication for WP REST APIs \< 4.8.0 Authentication Downgrade (CVSS 6.9)
- [CVE-2026-82229](https://cve.now/CVE-2026-82229.md): WordPress WordPress Social Login and Register plugin \<= 7.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-73351](https://cve.now/CVE-2026-73351.md): WordPress WordPress Social Login and Register plugin \<= 7.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-61979](https://cve.now/CVE-2026-61979.md): WordPress SAML SP Single Sign On plugin \<= 5.4.3 - Privilege Escalation vulnerability (CVSS 8.1)
- [CVE-2026-61967](https://cve.now/CVE-2026-61967.md): WordPress miniorange otp verification plugin \<= 5.5.1 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-28149](https://cve.now/CVE-2026-28149.md): WordPress Headless Single Sign On plugin \<= 1.6 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-28148](https://cve.now/CVE-2026-28148.md): WordPress Headless Single Sign On plugin \<= 1.6 - Bypass Vulnerability vulnerability (CVSS 9.8)
- [CVE-2026-28008](https://cve.now/CVE-2026-28008.md): WordPress OAuth Single Sign On – SSO (OAuth Client) plugin \<= 7.0.0 - Broken Authentication vulnerability (CVSS 9.8)
- [CVE-2026-65520](https://cve.now/CVE-2026-65520.md): WordPress WP OAuth Server plugin \<= 6.2.0 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-61957](https://cve.now/CVE-2026-61957.md): WordPress miniorange otp verification plugin \<= 5.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-65561](https://cve.now/CVE-2026-65561.md): WordPress WordPress Social Login and Register plugin \<= 7.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-59545](https://cve.now/CVE-2026-59545.md): WordPress miniOrange Discord Integration plugin \<= 2.2.4 - Broken Authentication vulnerability (CVSS 8.1)
- [CVE-2026-42731](https://cve.now/CVE-2026-42731.md): WordPress miniorange otp verification plugin \<= 5.4.9 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2021-47979](https://cve.now/CVE-2021-47979.md): WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion (CVSS 8.7)
- [CVE-2025-68974](https://cve.now/CVE-2025-68974.md): WordPress WordPress Social Login and Register plugin \<= 7.7.0 - Local File Inclusion vulnerability (CVSS 6.6)
- [CVE-2025-54745](https://cve.now/CVE-2025-54745.md): WordPress miniOrange's Google Authenticator Plugin \<= 6.1.1 - Broken Access Control Vulnerability (CVSS 6.5)
- [CVE-2025-53561](https://cve.now/CVE-2025-53561.md): WordPress Prevent files / folders access Plugin \<= 2.6.0 - Path Traversal Vulnerability (CVSS 6.5)
- [CVE-2025-54048](https://cve.now/CVE-2025-54048.md): WordPress Custom API for WP \<= 4.2.2 - SQL Injection Vulnerability (CVSS 9.3)
- [CVE-2025-54049](https://cve.now/CVE-2025-54049.md): WordPress Custom API for WP \<= 4.2.2 - Privilege Escalation Vulnerability (CVSS 9.9)
- [CVE-2025-31019](https://cve.now/CVE-2025-31019.md): WordPress Password Policy Manager plugin \<= 2.0.4 - Account Takeover vulnerability (CVSS 8.8)
- [CVE-2025-47670](https://cve.now/CVE-2025-47670.md): WordPress Social Login and Register plugin \<= 7.6.10 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-47672](https://cve.now/CVE-2025-47672.md): WordPress miniOrange Discord Integration plugin \<= 2.2.2 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-39545](https://cve.now/CVE-2025-39545.md): WordPress REST API Authentication plugin \<= 3.6.3 - Settings Change Vulnerability (CVSS 5.4)
- [CVE-2023-41873](https://cve.now/CVE-2023-41873.md): WordPress SAML Single Sign On – SSO Login plugin \<= 5.0.4 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-37987](https://cve.now/CVE-2023-37987.md): WordPress YourMembership Single Sign On plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2023-24375](https://cve.now/CVE-2023-24375.md): WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin \<= 7.5.14 - Broken Access Control vulnerability (CVSS 3.5)
- [CVE-2023-25455](https://cve.now/CVE-2023-25455.md): WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin \<= 7.6.0 - Arbitrary Content Deletion vulnerability (CVSS 5.3)
- [CVE-2023-47776](https://cve.now/CVE-2023-47776.md): WordPress miniorange otp verification plugin \<= 4.2.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-52176](https://cve.now/CVE-2023-52176.md): WordPress Malware Scanner plugin \<= 4.7.1 - IP Restriction Bypass vulnerability (CVSS 5.3)
- [CVE-2023-47683](https://cve.now/CVE-2023-47683.md): WordPress Social Login, Social Sharing by miniOrange plugin \<= 7.6.6 - Authenticated Privilege Escalation vulnerability (CVSS 8.0)
- [CVE-2024-25902](https://cve.now/CVE-2024-25902.md): WordPress Malware Scanner Plugin \<= 4.7.2 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2022-44589](https://cve.now/CVE-2022-44589.md): WordPress miniOrange's Google Authenticator Plugin \<= 5.6.1 is vulnerable to Sensitive Data Exposure (CVSS 8.1)
- [CVE-2023-37986](https://cve.now/CVE-2023-37986.md): WordPress YourMembership Single Sign On Plugin \<= 1.1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2022-34155](https://cve.now/CVE-2022-34155.md): WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin \<= 6.23.3 is vulnerable to Broken Authentication (CVSS 8.8)
- [CVE-2023-23706](https://cve.now/CVE-2023-23706.md): WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin \<= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-23710](https://cve.now/CVE-2023-23710.md): WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin \<= 7.5.14 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-1092](https://cve.now/CVE-2023-1092.md): OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF (CVSS 6.5)
- [CVE-2022-4496](https://cve.now/CVE-2022-4496.md): miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login (CVSS 6.1)
- [CVE-2023-23749](https://cve.now/CVE-2023-23749.md): Extension - miniorange - LDAP Integration - LDAP Injection (username) (CVSS 7.5)
- [CVE-2022-45073](https://cve.now/CVE-2022-45073.md): WordPress REST API Authentication plugin \<= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2022-42461](https://cve.now/CVE-2022-42461.md): WordPress miniOrange's Google Authenticator plugin \<= 5.6.1 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2022-34149](https://cve.now/CVE-2022-34149.md): WordPress WP OAuth Server plugin \<= 3.0.4 - Authentication Bypass vulnerability (CVSS 9.8)
- [CVE-2022-34858](https://cve.now/CVE-2022-34858.md): WordPress OAuth 2.0 client for SSO plugin \<= 1.11.3 - Authentication Bypass vulnerability (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/miniorange
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.