cyberlord92 Vulnerabilities and Affected Products
Vulnerabilities associated with Login with YourMembership – YM SSO Login.
Products
Clear product- Active Directory Integration / LDAP Integration4 vulnerabilities
- Miniorange OTP Verification with Firebase4 vulnerabilities
- OAuth Single Sign On – SSO (OAuth Client)4 vulnerabilities
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)3 vulnerabilities
- Page and Post Restriction3 vulnerabilities
- Broken Link Checker | Finder2 vulnerabilities
- Employee Directory – Staff Directory and Listing2 vulnerabilities
- Integrate Dynamics 365 CRM2 vulnerabilities
- PowerBI Embed Reports2 vulnerabilities
- SAML Single Sign On – SSO Login2 vulnerabilities
- Web Application Firewall – website security2 vulnerabilities
- All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login1 vulnerability
- Login with YourMembership – YM SSO Login1 vulnerability
- login_using_wordpress_users1 vulnerability
- Malware Scanner1 vulnerability
- miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator)1 vulnerability
- miniOrange OTP Login, Verification and SMS Notifications1 vulnerability
- miniOrange OTP Verification and SMS Notification for WooCommerce1 vulnerability
- Password Policy Manager | Password Manager1 vulnerability
- SAML IDP (Identity Provider) – Login with Website Users1 vulnerability
- Staff/Employee Business Directory for Active Directory1 vulnerability
- User Sync1 vulnerability
- Web3 – Crypto wallet Login & NFT token gating1 vulnerability
- WordPress Single Sign-On (SSO) - Multisite All-Inclusive1 vulnerability
- WordPress Single Sign-On (SSO) - Multisite Enterprise1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-10648MEDIUM | Login with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login. CWE-862Oct 15, 2025 | CVSS5.3v3.1 | EPSS0.286% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |