Veille CVE

Recherche « miniOrange WordPress Social Login and Register »

5 CVE

Critique 1 Élevée 3 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « miniOrange WordPress Social Login and Register » ✕
  1. CVE-2026-82229 7.1 Élevée

    miniOrange WordPress Social Login and Register

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

  2. CVE-2026-73351 7.1 Élevée

    miniOrange WordPress Social Login and Register

    Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

  3. CVE-2026-14300 8.1 Élevée

    Unknown miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)

    The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.

  4. CVE-2026-65561 6.5 Moyenne

    miniOrange WordPress Social Login and Register

    Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

  5. CVE-2026-12761 9.8 Critique

    cyberlord92 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)

    The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with send_otp_token() returning the SHA-512(customer_key || otp) transaction hash to the client where the OTP space is only 99,000 values (wp_rand(1000, 99999)) and the customer_key is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to mo_openid_social_login_validate_otp(), which logs the attacker in as the user whose email was supplied — granting full administrator access.