CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

CWE-266Aug 13, 2026
CVSS8.1v3.1EPSS-PoCs0SignalsSTIX

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

CWE-640Aug 13, 2026
CVSS9.8v3.1EPSS-PoCs0SignalsSTIX

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

CWE-502Aug 13, 2026
CVSS9.8v3.1EPSS-PoCs0SignalsSTIX

WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

CWE-347Aug 13, 2026
CVSS9.8v3.1EPSS-PoCs0SignalsSTIX

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

CWE-290Aug 13, 2026
CVSS9.8v3.1EPSS-PoCs0SignalsSTIX

WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

CWE-89Aug 6, 2026
CVSS9.3v3.1EPSS0.291%PoCs1SignalsSTIX

WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.

CWE-79Jul 27, 2026
CVSS7.1v3.1EPSS0.146%PoCs0SignalsSTIX

WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

CWE-79Jul 27, 2026
CVSS6.5v3.1EPSS0.13%PoCs0SignalsSTIX

WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

CWE-288Jul 23, 2026
CVSS8.1v3.1EPSS0.268%PoCs0SignalsSTIX

WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9.

CWE-266May 27, 2026
CVSS9.8v3.1EPSS0.333%PoCs0SignalsSTIX

WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion

WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.

CWE-22May 16, 2026
CVSS8.7v4.0EPSS0.397%PoCs1SignalsSTIX

WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0.

CWE-98Dec 30, 2025
CVSS6.6v3.1EPSS0.413%PoCs0SignalsSTIX

WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.

CWE-862Dec 18, 2025
CVSS6.5v3.1EPSS0.29%PoCs0SignalsSTIX

WordPress Prevent files / folders access Plugin <= 2.6.0 - Path Traversal Vulnerability

Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through <= 2.6.0.

CWE-35Aug 20, 2025
CVSS6.5v3.1EPSS0.424%PoCs0SignalsSTIX

WordPress Custom API for WP <= 4.2.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2.

CWE-89Aug 20, 2025
CVSS9.3v3.1EPSS0.418%PoCs0SignalsSTIX

WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability

Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2.

CWE-266Aug 20, 2025
CVSS9.9v3.1EPSS0.407%PoCs0SignalsSTIX

WordPress Password Policy Manager plugin <= 2.0.4 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through <= 2.0.4.

CWE-288Jun 9, 2025
CVSS8.8v3.1EPSS0.516%PoCs0SignalsSTIX

WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.6.10.

CWE-98May 23, 2025
CVSS8.1v3.1EPSS0.592%PoCs0SignalsSTIX

WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange miniOrange Discord Integration miniorange-discord-integration allows PHP Local File Inclusion.This issue affects miniOrange Discord Integration: from n/a through <= 2.2.2.

CWE-98May 23, 2025
CVSS8.1v3.1EPSS0.592%PoCs0SignalsSTIX

WordPress REST API Authentication plugin <= 3.6.3 - Settings Change Vulnerability

Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress REST API Authentication: from n/a through <= 3.6.3.

CWE-862Apr 16, 2025
CVSS5.4v3.1EPSS0.487%PoCs0SignalsSTIX

WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.

CWE-862Dec 13, 2024
CVSS4.3v3.1EPSS0.408%PoCs0SignalsSTIX

WordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign On: from n/a through 1.1.3.

CWE-862Dec 13, 2024
CVSS6.5v3.1EPSS0.584%PoCs0SignalsSTIX

WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14.

CWE-862Dec 9, 2024
CVSS3.5v3.1EPSS0.431%PoCs0SignalsSTIX

WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0.

CWE-862Dec 9, 2024
CVSS5.3v3.1EPSS0.73%PoCs0SignalsSTIX

WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through <= 4.2.1.

CWE-862Dec 9, 2024
CVSS4.3v3.1EPSS0.328%PoCs0SignalsSTIX