62
CVEs
10
Critical
27
High
0
KEV
25
PoC
26
Unpatched C/H
29.0%
Patch Rate
2.0%
Avg EPSS
Severity Breakdown
CRITICAL
10
HIGH
27
MEDIUM
22
LOW
3
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
24
Miniorange 2fa
7
Google Authenticator
6
Active Directory Integration Ldap Integration
6
PHP
4
Oauth Single Sign On
4
Saml Sp Single Sign On
3
Wordpress Social Login And Register Discord Google Twitter Linkedin
3
Wordpress Social Login And Register
3
Headless Single Sign On
2
Saml
2
Malware Scanner
2
Wp Oauth Server
2
Otp Verification With Firebase
2
Page Restriction
2
Oauth Openid Connect Single Sign On
1
Login Using Wordpress Users
1
Oauth 2 0 Client For Sso
1
Backup And Restore
1
Prevent Files Folders Access
1
Limit Login Attempts
1
Web3 Crypto Wallet Login Nft Token Gating
1
Discord Integration
1
Miniorange Otp Verification
1
Wordpress Rest Api Authentication
1
Login With Otp Over Sms Email Whatsapp And Google Authenticator
1
LDAP
1
Wordpress Security
1
Social Login
1
Ldap Integration With Active Directory And Openldap
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2023-2982 | The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 70.1%. | CRITICAL | 9.8 | 70.1% | 139 |
PoC
No patch
|
| CVE-2022-34858 | Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.3% | 69 |
PoC
No patch
|
| CVE-2022-34155 | Improper Authentication vulnerability in miniOrange OAuth Single Sign On - SSO (OAuth Client) plugin allows Authentication Bypass.23.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.2% | 64 |
PoC
No patch
|
| CVE-2021-47979 | WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.7 | 0.0% | 64 |
PoC
No patch
|
| CVE-2022-0229 | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.1 | 0.5% | 60 |
PoC
No patch
|
| CVE-2026-77771 | Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3. | HIGH | 7.5 | 0.1% | 58 |
PoC
|
| CVE-2023-0812 | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.8% | 58 |
PoC
No patch
|
| CVE-2023-5003 | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 25.9% | 58 |
PoC
No patch
|
| CVE-2023-4238 | The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.2 | 1.3% | 56 |
PoC
No patch
|
| CVE-2022-3082 | The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.4% | 52 |
PoC
No patch
|
| CVE-2023-1092 | The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.4% | 52 |
PoC
No patch
|
| CVE-2023-1093 | The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.3% | 52 |
PoC
No patch
|
| CVE-2019-12346 | In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 1.1% | 50 |
PoC
No patch
|
| CVE-2020-6850 | Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 1.4% | 50 |
PoC
No patch
|
| CVE-2026-28008 | Authentication bypass in the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin (versions 7.0.0 and earlier) lets an unauthenticated remote attacker defeat the OAuth login flow and authenticate as an arbitrary user, including administrators. The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and the issue is rooted in improper verification of the identity asserted during single sign-on (CWE-290). At the time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the combination of unauthenticated access and full account takeover makes it a high-priority patching target. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|