OTP-less one tap Sign in 2.0.14 - 2.0.59 - Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation
critical
The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the plugin not properly validating a user's identity prior to updating their details, like email. This makes it possible for unauthenticated attackers to change arbit...
- CVSS:
- 9.8
- Affected:
- 2.0.14 – 2.0.59
- Fix:
- No patched version reported
- Disclosed:
- May 1, 2025
CVE-2025-3746 on NVD →
OTP-less one tap Sign in <= 2.0.58 - Reflected Cross-Site Scripting
medium
The OTP-less one tap Sign in plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.0.58 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can su...
- CVSS:
- 6.1
- Affected:
- up to 2.0.58
- Fixed in:
- 2.0.59
- Disclosed:
- Apr 14, 2025
CVE-2025-32622 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database