Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-120844

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress-extensions
Products
Oauth Single Sign On – Sso (oauth Client) Oauth Single Sign On – Sso (oauth Client)
CVE-2022-34155

WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication

Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Oauth Single Sign On
CVE-2023-1093

OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF

The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Oauth Single Sign On
CVE-2023-1092

OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange
Products
Oauth Single Sign On
CVE-2022-2133

OAuth Single Sign On < 6.22.6 - Authentication Bypass

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Miniorange
Products
Oauth Single Sign On