miniOrange Vulnerabilities and Affected Products
Vulnerabilities associated with WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn).
Products
Clear product- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)5 vulnerabilities
- miniorange otp verification4 vulnerabilities
- WordPress Social Login and Register3 vulnerabilities
- Custom API for WP2 vulnerabilities
- Headless Single Sign On2 vulnerabilities
- Malware Scanner2 vulnerabilities
- miniOrange Discord Integration2 vulnerabilities
- OAuth Single Sign On – SSO (OAuth Client)2 vulnerabilities
- otp_verification2 vulnerabilities
- SAML SP Single Sign On2 vulnerabilities
- web_application_firewall2 vulnerabilities
- wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\)2 vulnerabilities
- Backup and Restore1 vulnerability
- LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login1 vulnerability
- Malware Scanner plugin and Web Application Firewall plugin for WordPress1 vulnerability
- malware_scanner1 vulnerability
- miniOrange WordPress SAML SSO Premium1 vulnerability
- miniOrange WordPress SAML SSO Premium MulsiteSite1 vulnerability
- miniOrange WordPress SAML SSO Standard1 vulnerability
- miniOrange's Google Authenticator1 vulnerability
- miniOrange's Google Authenticator (WordPress plugin)1 vulnerability
- miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login1 vulnerability
- OAuth 2.0 client for SSO (WordPress plugin)1 vulnerability
- OAuth Single Sign On Enterprise1 vulnerability
- OAuth Single Sign On Free1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control vulnerabilityMissing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14. CWE-862Dec 9, 2024 | CVSS3.5v3.1 | EPSS0.431% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-25455MEDIUM | WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerabilityMissing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0. CWE-862Dec 9, 2024 | CVSS5.3v3.1 | EPSS0.73% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47683HIGH | WordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerabilityImproper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6. CWE-269May 17, 2024 | CVSS8.0v3.1 | EPSS0.479% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-23706MEDIUM | WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions. CWE-352May 23, 2023 | CVSS4.3v3.1 | EPSS0.256% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-23710MEDIUM | WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions. CWE-79Apr 25, 2023 | CVSS5.9v3.1 | EPSS0.369% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |