Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 92

Export CSV
CVE-2026-62126

WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress-extensions
Products
Saml Sp Single Sign On Saml Sp Single Sign On
CVE-2026-120844

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress-extensions
Products
Oauth Single Sign On – Sso (oauth Client) Oauth Single Sign On – Sso (oauth Client)
CVE-2026-107433

WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress-extensions
Products
Wp Oauth Server Wp Oauth Server
CVE-2026-89027

miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Jwt Authentication For Wp Rest Apis Wordpress
CVE-2026-81205

LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal Miniorange
Products
Ldap / Active Directory Integration Ldap \/ Active Directory Integration
CVE-2026-61967

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Otp Verification Wordpress
CVE-2026-16619

miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Miniorange 2fa Wordpress
CVE-2026-16036

miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Miniorange 2fa Wordpress
CVE-2026-14300

miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Wordpress Social Login And Register (discord, Google, Twitter, Linkedin) Wordpress
CVE-2026-16035

miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Miniorange 2fa Wordpress
CVE-2026-61957

WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Otp Verification Wordpress