Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · miniorange-login-openid
WordPress Social Login and Register
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Is WordPress Social Login and Register safe? The full page →
Aug 31, 2026Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.CVE-2026-82229 · affects up to 7.8.2 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.CVE-2026-73351 · affects up to 7.8.1 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
Jul 29, 2026miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn): Does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued forCVE-2026-14300 · fixed in 7.8.0 · reported by WPScanHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
Jul 27, 2026Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.CVE-2026-65561 · affects up to 7.8.0 · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.
Jul 10, 2026miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn): Authentication bypass leading to account takeoverCVE-2026-12761 · affects up to 7.7.0 · reported by WordfenceCritical 9.8
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with send_otp_token() returning the SHA-512(customer_key || otp) transaction hash to the client where the OTP space is only 99,000 values (wp_rand(1000, 99999)) and the customer_key is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to mo_openid_social_login_validate_otp(), which logs the attacker in as the user whose email was supplied — granting full administrator access.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 30, 2025WordPress Social Login and Register: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68974 · affects up to 7.7.0 · reported by PatchstackMedium 6.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0.
May 23, 2025WordPress Social Login and Register: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47670 · affects up to 7.6.10 · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.6.10.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-25455 · affects up to 7.6.0 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-24375 · affects up to 7.5.14 · reported by PatchstackLow 3.5
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14.
May 17, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Improper Privilege ManagementCVE-2023-47683 · affects up to 7.6.6 · reported by PatchstackHigh 8
Improper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6.
Jun 28, 2023WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Authentication bypassCVE-2023-2982 · affects up to 7.6.4 · reported by WordfenceCritical 9.8
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
May 23, 2023miniOrange WordPress Social Login and Register: Cross-Site Request Forgery (CSRF)CVE-2023-23706 · fixed in 7.6.0 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
Apr 25, 2023miniOrange WordPress Social Login and Register: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23710 · fixed in 7.6.0 · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.