Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Oct 30, 2026Security Plugin, Firewall & Malware Scanner with Auto Removal: Does not verify the account password before accepting an authenticator-app two-factor code at loginCVE-2026-114443 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.
- Product
- Security Plugin, Firewall & Malware Scanner with Auto Removal
- Fixed in
- 2.191
- What to do
- Update Security Plugin, Firewall & Malware Scanner with Auto Removal to 2.191 or newer.
Aug 6, 2026Google Authenticator: Does not verify a CSRF nonceCVE-2026-14204 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.
- Product
- Google Authenticator
- Fixed in
- 0.56
- What to do
- Update Google Authenticator to 0.56 or newer.
Dec 18, 2025miniOrange's Google Authenticator: Missing AuthorizationCVE-2025-54745 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.
- Product
- miniOrange's Google Authenticator
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update miniOrange's Google Authenticator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication –CVE-2022-44589 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1.
- Affected
- up to 5.6.1
- What to do
- Affects up to 5.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 20, 2023miniOrange's Google Authenticator: Authorization bypassCVE-2022-4943 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings.
- Product
- miniOrange's Google Authenticator
- Affected
- up to 5.6.5
- What to do
- Affects up to 5.6.5. Update miniOrange's Google Authenticator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 2, 2023Authenticator: Does not prevent subscribers from updating a site's feed access tokenCVE-2022-3994 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the functionality in certain configurations.
- Product
- Authenticator
- Fixed in
- 1.3.1
- What to do
- Update Authenticator to 1.3.1 or newer.
Nov 18, 2022Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.CVE-2022-42461 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.
- Affected
- up to 5.6.1
- What to do
- Affects up to 5.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 27, 2022Login With OTP Over SMS, Email, WhatsApp and Google Authenticator: Does not escape its settingsCVE-2022-1994 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Login With OTP Over SMS, Email, WhatsApp and Google Authenticator
- Fixed in
- 1.0.8
- What to do
- Update Login With OTP Over SMS, Email, WhatsApp and Google Authenticator to 1.0.8 or newer.
Jun 27, 2022miniOrange's Google Authenticator: Does not sanitise and escape some of its settingsCVE-2022-1321 · WordPress plugins & themes · reported by WPScanMedium 4.8
The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- miniOrange's Google Authenticator
- Fixed in
- 5.5.6
- What to do
- Update miniOrange's Google Authenticator to 5.5.6 or newer.
Jun 27, 2022Google Authenticator: Does not have CSRF checkCVE-2022-0875 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
- Product
- Google Authenticator
- Fixed in
- 1.0.5
- What to do
- Update Google Authenticator to 1.0.5 or newer.
Mar 21, 2022miniOrange's Google Authenticator: Does not have proper authorisation and CSRF checksCVE-2022-0229 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
- Product
- miniOrange's Google Authenticator
- Fixed in
- 5.5
- What to do
- Update miniOrange's Google Authenticator to 5.5 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.