CVE-2026-65888

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65888

The CVE concerns Joomla extension Gridbox by balbooa.com, with versions older than 2.20.2. The underlying issue is a vulnerability in the socialLogin method that can allow an attacker to log in as any user on the target site, i.e., an account takeover. The CVSS 4.0 score is 10.0 (CRITICAL) with n...

EUVD-2026-50356

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...

CVE-2026-14300

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

EUVD-2026-50121

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

CVE-2026-14300

The CVE affects the miniOrange Social Login and Register WordPress plugin (Discord, Google, Twitter, LinkedIn) before 7.8.0. The one-time code used by the optional email-verification (Profile Completion) feature is not bound to the issued account, allowing an unauthenticated attacker to obtain a ...

CVE-2026-14300 miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username...

Miniorange Social Login and Register <= 7.6.3 - Authentication Bypass

The WordPress Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes...

Social Login by BestWebSoft < 0.2 - Cross-Site Scripting

The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues. id: CVE-2017-18501 info: name: Social Login by BestWebSoft 0.2 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues...

PT-2026-65697

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

CVE-2026-65561

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

CVE-2026-65561

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

CVE-2026-65561

CVE-2026-65561 concerns the WordPress WordPress Social Login and Register plugin (versions

CVE-2026-65561 WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

EUVD-2026-49234

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WordPress Social Login and Register versions = 7.8.0...

CVE-2026-12761 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the...

EUVD-2026-43026

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the...