Vulnerabilities > Miniorange > Medium

DATE CVE VULNERABILITY TITLE RISK
2023-01-02 CVE-2022-4200 Unspecified vulnerability in Miniorange Login With Cognito
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
network
low complexity
miniorange
4.8
2022-10-17 CVE-2022-3082 Missing Authorization vulnerability in Miniorange Discord Integration
The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example
network
low complexity
miniorange CWE-862
6.5
2022-07-17 CVE-2022-2133 Improper Authentication vulnerability in Miniorange Oauth Single Sign on
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.
network
low complexity
miniorange CWE-287
5.0
2022-06-27 CVE-2022-0875 Cross-Site Request Forgery (CSRF) vulnerability in Miniorange Google Authenticator
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
4.3
2021-08-13 CVE-2021-36786 Insecure Storage of Sensitive Information vulnerability in Miniorange Saml
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
network
low complexity
miniorange CWE-922
5.0
2020-02-17 CVE-2020-6850 Cross-site Scripting vulnerability in Miniorange Saml SP Single Sign ON
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php.
network
miniorange CWE-79
4.3
2019-06-24 CVE-2019-12346 Cross-site Scripting vulnerability in Miniorange Saml SP Single Sign ON
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.
network
miniorange CWE-79
4.3