Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2022-44589

WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Google Authenticator
CVE-2025-54745

WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress
Products
Google Authenticator Wordpress
CVE-2022-4943

miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change

The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Google Authenticator
CVE-2022-42461

WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Google Authenticator
CVE-2022-1321

miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site Scripting

The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Google Authenticator
CVE-2022-0875

miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting

The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Google Authenticator
CVE-2022-0229

miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Google Authenticator