3
CVEs
0
Critical
3
High
0
KEV
1
PoC
2
Unpatched C/H
33.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
24
Miniorange 2fa
7
Google Authenticator
6
Active Directory Integration Ldap Integration
6
PHP
4
Oauth Single Sign On
4
Saml Sp Single Sign On
3
Wordpress Social Login And Register Discord Google Twitter Linkedin
3
Wordpress Social Login And Register
3
Headless Single Sign On
2
Saml
2
Malware Scanner
2
Wp Oauth Server
2
Otp Verification With Firebase
2
Page Restriction
2
Oauth Openid Connect Single Sign On
1
Login Using Wordpress Users
1
Oauth 2 0 Client For Sso
1
Backup And Restore
1
Prevent Files Folders Access
1
Limit Login Attempts
1
Web3 Crypto Wallet Login Nft Token Gating
1
Discord Integration
1
Miniorange Otp Verification
1
Wordpress Rest Api Authentication
1
Login With Otp Over Sms Email Whatsapp And Google Authenticator
1
LDAP
1
Wordpress Security
1
Social Login
1
Ldap Integration With Active Directory And Openldap
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77771 | Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3. | HIGH | 7.5 | 0.1% | 58 |
PoC
|
| CVE-2026-73351 | Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-82229 | Unauthenticated XSS in miniOrange's WordPress Social Login and Register plugin (versions 7.8.2 and earlier) allows remote attackers to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL targeting the plugin's social login flow. The scope-changed CVSS vector (S:C) confirms cross-context impact, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis. | HIGH | 7.1 | 0.1% | 36 |
No patch
|