plugin

Miniorange Openid Connect Client Vulnerabilities

2 known security issues reported for the Miniorange Openid Connect Client WordPress plugin. Most recent disclosed Jun 23, 2022.

1 critical 1 medium

Running Miniorange Openid Connect Client on your site? Check whether your installed version is affected.

Scan your site free

WordPress OpenID Connect Client <= 2.1.7 - Authentication Bypass

critical

The WordPress OpenID Connect Client plugin for WordPress is vulnerable to authentication bypass in versions up to, and including 2.1.7. This is due to the plugin accepting a user supplied email address that is passed to wp_set_auth_cookie() with no further identity validation to verify that the email supplied belongs t...

CVSS:
9.8
Affected:
up to 2.1.7
Fixed in:
2.1.8
Disclosed:
Jun 23, 2022

Multiple miniOrange Plugins (Various Version) - Reflected Cross-Site Scripting

medium

Multiple miniorange Plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'appId' parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user...

CVSS:
6.1
Affected:
up to 2.1.4
Fixed in:
2.1.5
Disclosed:
Aug 30, 2021

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database