en
miniOrange is an identity and access management provider founded in 2012. It develops cloud and on-premise security products for authentication, authorization, and identity lifecycle management, including enterprise integrations and WordPress extensions. The company describes its customer base as global.
As of 11/08/2026, miniOrange recorded 17 security vulnerabilities in the last 90 days across 9 products, including 12 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Headless Single Sign On had the most security vulnerabilities in the miniOrange ecosystem, with 3 vulnerabilities—approximately 17.65% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-120844WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerabilityCVE-2026-62126WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerabilityCVE-2026-54852WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerabilityCVE-2026-114696WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerabilityCVE-2026-107433WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-120844WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability | Exploitation statusNot confirmed | FixYes |
| Affected productOAuth Single Sign On – SSO (OAuth Client) |
| Published11/06/2026 |
| SeverityCritical |
CVE-2026-62126WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability | Exploitation statusNot exploited | FixYes | Affected productSAML SP Single Sign On | Published11/04/2026 | SeverityHigh |
|---|
CVE-2026-54852WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productPage Restriction WordPress (WP) | Published10/29/2026 | SeverityMedium |
|---|
CVE-2026-114696WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productPage Restriction WordPress (WP) | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-107433WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP OAuth Server | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-106610WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Affected productminiorange otp verification | Published10/10/2026 | SeverityCritical |
|---|
CVE-2026-97274Unauthenticated authentication bypass in miniOrange WordPress OAuth Single Sign On, SSO (OAuth Client) | Exploitation statusNot exploited | FixYes | Affected productOAuth Single Sign On – SSO (OAuth Client) | Published09/30/2026 | SeverityCritical |
|---|
CVE-2026-97267WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productPrevent files / folders access | Published09/30/2026 | SeverityMedium |
|---|
CVE-2026-62108WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability | Exploitation statusNot exploited | FixYes | Affected productHeadless Single Sign On | Published09/17/2026 | SeverityCritical |
|---|
CVE-2026-89027miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade | Exploitation statusNot exploited | FixYes | Affected productJWT Authentication for WP REST APIs | Published09/15/2026 | SeverityMedium |
|---|
CVE-2026-82229WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register | Published08/31/2026 | SeverityHigh |
|---|
CVE-2026-73351WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register | Published08/18/2026 | SeverityHigh |
|---|
CVE-2026-61979WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Affected productSAML SP Single Sign On | Published08/13/2026 | SeverityHigh |
|---|
CVE-2026-61967WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Affected productminiorange otp verification | Published08/13/2026 | SeverityCritical |
|---|
CVE-2026-28149WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productHeadless Single Sign On | Published08/13/2026 | SeverityCritical |
|---|
CVE-2026-28148WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability | Exploitation statusNot exploited | FixYes | Affected productHeadless Single Sign On | Published08/13/2026 | SeverityCritical |
|---|
CVE-2026-28008Authentication bypass in miniOrange OAuth Single Sign On, SSO (OAuth Client) | Exploitation statusNot exploited | FixYes | Affected productOAuth Single Sign On – SSO (OAuth Client) | Published08/13/2026 | SeverityCritical |
|---|
CVE-2026-65520WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP OAuth Server | Published08/06/2026 | SeverityCritical |
|---|
CVE-2026-65561WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register | Published07/27/2026 | SeverityMedium |
|---|
CVE-2026-61957WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productminiorange otp verification | Published07/27/2026 | SeverityHigh |
|---|
CVE-2026-59545WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability | Exploitation statusNot exploited | FixYes | Affected productminiOrange Discord Integration | Published07/23/2026 | SeverityHigh |
|---|
CVE-2026-42731WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Affected productminiorange otp verification | Published05/27/2026 | SeverityCritical |
|---|
CVE-2021-47979WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion | Exploitation statusActively exploited | FixNo | Affected productBackup and Restore | Published05/16/2026 | SeverityHigh |
|---|
CVE-2025-68974WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register | Published12/30/2025 | SeverityMedium |
|---|
CVE-2025-54745WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control Vulnerability | Exploitation statusNot exploited | FixYes | Affected productminiOrange's Google Authenticator | Published12/18/2025 | SeverityMedium |
|---|
CVE-2025-54049WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability | Exploitation statusNot exploited | FixYes | Affected productCustom API for WP | Published08/20/2025 | SeverityCritical |
|---|
CVE-2025-54048WordPress Custom API for WP <= 4.2.2 - SQL Injection Vulnerability | Exploitation statusNot exploited | FixYes | Affected productCustom API for WP | Published08/20/2025 | SeverityCritical |
|---|
CVE-2025-53561WordPress Prevent files / folders access Plugin <= 2.6.0 - Path Traversal Vulnerability | Exploitation statusNot exploited | FixYes | Affected productPrevent files / folders access | Published08/20/2025 | SeverityMedium |
|---|
CVE-2025-31019WordPress Password Policy Manager plugin <= 2.0.4 - Account Takeover vulnerability | Exploitation statusNot exploited | FixYes | Affected productPassword Policy Manager | Published06/09/2025 | SeverityHigh |
|---|
CVE-2025-47672WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion Vulnerability | Exploitation statusNot exploited | FixYes | Affected productminiOrange Discord Integration | Published05/23/2025 | SeverityHigh |
|---|
CVE-2025-47670WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion Vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register | Published05/23/2025 | SeverityHigh |
|---|
CVE-2025-39545WordPress REST API Authentication plugin <= 3.6.3 - Settings Change Vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress REST API Authentication | Published04/16/2025 | SeverityMedium |
|---|
CVE-2023-41873WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productSAML SP Single Sign On | Published12/13/2024 | SeverityMedium |
|---|
CVE-2023-37987WordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productYourMembership Single Sign On | Published12/13/2024 | SeverityMedium |
|---|
CVE-2023-47776WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productminiorange otp verification | Published12/09/2024 | SeverityMedium |
|---|
CVE-2023-25455WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) | Published12/09/2024 | SeverityMedium |
|---|
CVE-2023-24375WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) | Published12/09/2024 | SeverityLow |
|---|
CVE-2023-52176WordPress Malware Scanner plugin <= 4.7.1 - IP Restriction Bypass vulnerability | Exploitation statusNot exploited | FixYes | Affected productMalware Scanner | Published06/04/2024 | SeverityMedium |
|---|
CVE-2023-47683WordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) | Published05/17/2024 | SeverityHigh |
|---|
CVE-2024-25902WordPress Malware Scanner Plugin <= 4.7.2 is vulnerable to SQL Injection | Exploitation statusNot exploited | FixYes | Affected productMalware Scanner | Published02/28/2024 | SeverityHigh |
|---|
CVE-2022-44589WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure | Exploitation statusNot exploited | FixYes | Affected productminiOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login | Published12/29/2023 | SeverityHigh |
|---|
CVE-2023-37986WordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS) | Exploitation statusNot exploited | FixYes | Affected productYourMembership Single Sign On – YM SSO Login | Published09/01/2023 | SeverityMedium |
|---|
CVE-2022-34155WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication | Exploitation statusActively exploited | FixYes | Affected productOAuth Single Sign On – SSO (OAuth Client) | Published07/18/2023 | SeverityHigh |
|---|
CVE-2023-23706WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF) | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) | Published05/23/2023 | SeverityMedium |
|---|
CVE-2023-23710WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS) | Exploitation statusNot exploited | FixYes | Affected productWordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) | Published04/25/2023 | SeverityMedium |
|---|
CVE-2023-1092OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF | Exploitation statusActively exploited | FixYes | Affected productOAuth Single Sign On Enterprise | Published03/27/2023 | SeverityMedium |
|---|
CVE-2022-4496miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login | Exploitation statusActively exploited | FixYes | Affected productminiOrange WordPress SAML SSO Premium | Published01/30/2023 | SeverityMedium |
|---|
CVE-2023-23749Extension - miniorange - LDAP Integration - LDAP Injection (username) | Exploitation statusNot exploited | FixNo | Affected productLDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login | Published01/17/2023 | SeverityHigh |
|---|
CVE-2022-45073WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWordPress REST API Authentication (WordPress plugin) | Published11/18/2022 | SeverityMedium |
|---|
CVE-2022-42461WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productminiOrange's Google Authenticator (WordPress plugin) | Published11/18/2022 | SeverityMedium |
|---|
52 Results | Page 1 of 2