52 matches found
WordPress miniOrange OTP Login, Verification and SMS Notifications plugin <= 5.5.5 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin miniorange otp verification versions = 5.5.5...
CVE-2026-85984
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...
EUVD-2026-87786
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...
CVE-2026-85984
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions up to and including 5.5.5 ) is vulnerable to an Authentication Bypass . The root cause is a missing password-intent guard in the mo_by_pass_login() function when the skip_pass_fallback configuration is ena...
CVE-2026-85984 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...
CVE-2026-85984 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mowploginintent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skippassfallback-enabled configuration bran...
CVE-2026-61967
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
CVE-2026-61967
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
EUVD-2026-57972
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
CVE-2026-61967
CVE-2026-61967 concerns an unauthenticated privilege-escalation vulnerability in the WordPress plugin miniorange OTP Verification (versions
CVE-2026-61967 WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
CVE-2026-61967 WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
CVE-2026-61967: Weak Password Recovery Mechanism for Forgotten Password
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
PT-2026-71538
Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...
WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by VDsec in WordPress Plugin miniorange otp verification versions = 5.5.1...
CVE-2026-61957 WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Tarcísio LuchesiPoystick in WordPress Plugin miniorange otp verification versions = 5.5.1...
CVE-2026-61957: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
CVE-2026-14245 miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the umresetpasswordprocesshook function performing no server-side...
CVE-2026-14245: Missing Authorization
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the umresetpasswordprocesshook function performing no server-side...