CVE-2026-14300 miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

CVE-2026-14300

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin, in versions before 7.8.0 , is vulnerable to an unauthenticated account takeover . The root cause is a failure to bind the one-time code used by the optional email-verification (Profile Completion) feat...

CVE-2026-14300: Improper Authentication

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

WordPress miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover vulnerability

Unauthenticated Authentication Bypass to Administrator Account Takeover vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WordPress Social Login and Register versions = 7.7.0...

CVE-2026-12761: Improper Authentication

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the...

PT-2026-57277

Name of the Vulnerable Software and Affected Versions miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn versions prior to 7.7.1 Description An authentication bypass exists in the Profile Completion flow that allows for account takeover. The issue occurs because the plugin...

CVE-2025-47670

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through =...

WordPress miniOrange Social Login and Register Pro Addon plugin <= 200.3.9 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin miniOrange Social Login and Register Pro Addon versions = 200.3.9...

CVE-2024-11087: Improper Authentication

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This make...

CVE-2023-25455

Missing Authorization vulnerability in miniOrange WordPress Social Login and Register Discord, Google, Twitter, LinkedIn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register Discord, Google, Twitter, LinkedIn: from n/a...

Critical Security Flaw in Social Login Plugin for WordPress Exposes Users' Accounts

A critical security flaw has been disclosed in miniOrange's Social Login and Register plugin for WordPress that could enable a malicious actor to log in as any user-provided information about email address is already known. Tracked as CVE-2023-2982 CVSS score: 9.8, the authentication bypass flaw...