M
Vendor security profile
miniorange
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs15
Critical8
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS8.3
12-month vulnerability rate
0
0
0
0
0
0
1
0
0
8
5
1
CVE KEV
CVE severity distribution
15toplam CVE
Critical8 (53%)
High4 (27%)
Medium3 (20%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
15Unknown
Latest vulnerabilities
9.8
CVE-2026-106610
WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
M
Patch status unknownEPSS %0
9.8
CVE-2026-97274
WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability
M
Patch status unknownEPSS %0
4.3
CVE-2026-97267
WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability
M
Patch status unknownEPSS %0
9.8
CVE-2026-62108
WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability
M
Patch status unknownEPSS %1
6.9
CVE-2026-89027
miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade
M
Patch status unknownEPSS %0
5.3
CVE-2026-81205
Vulnerability in Miniorange LDAP / Active Directory Integration
M
Patch status unknownEPSS %0
7.1
CVE-2026-82229
WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability
M
Patch status unknownEPSS %0
10.0
CVE-2026-77998
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4
M
Patch status unknownEPSS %1
10.0
CVE-2026-77995
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0
M
Patch status unknownEPSS %0
7.1
CVE-2026-73351
WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability
M
Patch status unknownEPSS %0