11
CVEs
5
Critical
5
High
0
KEV
1
PoC
9
Unpatched C/H
9.1%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
5
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
24
Miniorange 2fa
7
Google Authenticator
6
Active Directory Integration Ldap Integration
6
PHP
4
Oauth Single Sign On
4
Saml Sp Single Sign On
3
Wordpress Social Login And Register Discord Google Twitter Linkedin
3
Wordpress Social Login And Register
3
Headless Single Sign On
2
Saml
2
Malware Scanner
2
Wp Oauth Server
2
Otp Verification With Firebase
2
Page Restriction
2
Oauth Openid Connect Single Sign On
1
Login Using Wordpress Users
1
Oauth 2 0 Client For Sso
1
Backup And Restore
1
Prevent Files Folders Access
1
Limit Login Attempts
1
Web3 Crypto Wallet Login Nft Token Gating
1
Discord Integration
1
Miniorange Otp Verification
1
Wordpress Rest Api Authentication
1
Login With Otp Over Sms Email Whatsapp And Google Authenticator
1
LDAP
1
Wordpress Security
1
Social Login
1
Ldap Integration With Active Directory And Openldap
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77771 | Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3. | HIGH | 7.5 | 0.1% | 58 |
PoC
|
| CVE-2026-28008 | Authentication bypass in the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin (versions 7.0.0 and earlier) lets an unauthenticated remote attacker defeat the OAuth login flow and authenticate as an arbitrary user, including administrators. The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and the issue is rooted in improper verification of the identity asserted during single sign-on (CWE-290). At the time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the combination of unauthenticated access and full account takeover makes it a high-priority patching target. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-28149 | Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-61967 | Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-28148 | Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-65520 | SQL injection in the miniOrange WP OAuth Server WordPress plugin (all versions up to and including 6.2.0) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's OAuth request handling, per CVSS:3.1 PR:N. The flaw carries a critical 9.3 score with a changed-scope confidentiality impact, meaning attacker-controlled queries can reach data beyond the intended authorization boundary. Reported by Patchstack (CVE-2026-65520 / EUVD-2026-53969); no public exploit identified at time of analysis. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-61979 | Unauthenticated privilege escalation in the miniOrange SAML SP Single Sign On WordPress plugin (versions ≤ 5.4.3) allows network-accessible attackers to elevate their privileges without any prior authentication. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates exploitation is remotely achievable but requires specific conditions to be met - likely particular SAML configuration states or timing-sensitive request manipulation. Full confidentiality, integrity, and availability impact is reported, consistent with an attacker reaching WordPress administrator-level access. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-59545 | Authentication bypass in the miniOrange Discord Integration plugin for WordPress (versions 2.2.4 and earlier) lets remote unauthenticated attackers defeat the plugin's identity verification (CWE-288) and assume the identity of legitimate WordPress users, including potentially privileged accounts. Rated CVSS 8.1 (High) by Patchstack, the flaw carries full confidentiality, integrity, and availability impact but a high attack complexity that tempers real-world exploitability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-73351 | Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-82229 | Unauthenticated XSS in miniOrange's WordPress Social Login and Register plugin (versions 7.8.2 and earlier) allows remote attackers to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL targeting the plugin's social login flow. The scope-changed CVSS vector (S:C) confirms cross-context impact, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-65561 | Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time. | MEDIUM | 6.5 | 0.1% | 32 |
No patch
|