miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

The plugin does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example PoC Run the below command in the developer console of the web browser while being on the blog as any user, such as subscriber...

WordPress miniOrange Discord Integration plugin <= 2.1.5 - Authenticated App Disabling vulnerability

Authenticated App Disabling vulnerability discovered by Lana Codes in WordPress miniOrange Discord Integration plugin versions = 2.1.5. Solution Update the WordPress miniOrange Discord Integration plugin to the latest available version at least 2.1.6...

CVE-2022-34858

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...

CVE-2022-34858

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...

CVE-2022-34149

Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin = 3.0.4 at WordPress...

CVE-2022-34149

Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin = 3.0.4 at WordPress...

Authentication flaw

Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin = 3.0.4 at WordPress...

Authentication flaw

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...

CVE-2022-34149 WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability

Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin = 3.0.4 at WordPress...

CVE-2022-34149

CVE-2022-34149 : Authentication bypass in the WordPress plugin miniOrange WP OAuth Server for versions

CVE-2022-34858 WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...

CVE-2022-34858

CVE-2022-34858 affects the miniOrange OAuth 2.0 client for SSO WordPress plugin (

PT-2022-22398 · Miniorange · Miniorange Oauth 2.0 Client For Sso Plugin

Name of the Vulnerable Software and Affected Versions: miniOrange OAuth 2.0 client for SSO plugin versions = 1.11.3 Description: The issue is related to an Authentication Bypass vulnerability. It affects the miniOrange OAuth 2.0 client for SSO plugin at WordPress. Recommendations: For versions =...

PT-2022-22022 · WordPress · Miniorange Wp Oauth Server

Name of the Vulnerable Software and Affected Versions: miniOrange WP OAuth Server plugin versions = 3.0.4 Description: The issue is related to an Authentication Bypass vulnerability. It affects the miniOrange WP OAuth Server plugin at WordPress. Recommendations: For versions = 3.0.4, update to a...

CVE-2022-1321

The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml is disallowed for example ...

Cross site scripting

The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml is disallowed for example ...

CVE-2022-1995 miniOrange's Malware Scanner < 4.5.2 - Admin+ Stored Cross-Site Scripting

The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml is disallowed for example in multisite setup...

CVE-2022-1321

The CVE-2022-1321 entry concerns miniOrange’s Google Authenticator WordPress plugin, versions before 5.5.6. The vulnerability is a stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitization/escaping of certain settings, enabling an administrator to inject JavaScript that executes ...

miniOrange's Google Authenticator < 5.5.75 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=mo2fatwofa"...

miniOrange's Google Authenticator < 5.5.75 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting https://example.com/wp-admin/admin.php?page=mo2fatwofa&a"alert/XSS/...