SecAlerts
m

miniorange

Security Risk Profile

63
/100
high

Security Risk Score

Comprehensive risk assessment based on 90 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from June 24, 2019 to present

90
Total CVEs
51
Critical+High
0
Exploited
38
Unpatched

Threat Assessment

Avg CVSS
7.3
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
38
Critical/High
Risk Level
63/100
high
🆕 1Fresh (<7d)📈 6 in Last 30 Days

Severity Distribution

Critical
20
High
31
Medium
38
Low
1

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
13

Age Distribution

Common Weaknesses (CWE)

1
XSS
14
2
CSRF
9
3
SQL Injection
4
4
Infoleak
3
5
Path Traversal
1

Most Affected Products

1. miniOrange Saml Sso - Service Provider Drupal78
2. miniOrange Miniorange 2fa Drupal12
3. miniOrange Oauth Single Sign On Wordpress7
4. miniOrange Google Authenticator WordPress6
5. miniOrange Active Directory Integration \/ Ldap Integration Wordpress6

Recent Vulnerabilities

See more →
CVE-2026-120844
CVSS 9.8critical

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

Nov 6, 2026🔧 No Patch
CVE-2026-62126
CVSS 7.5high

WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability

Nov 4, 2026🔧 No Patch
CVE-2026-114696
CVSS 5.3medium

WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability

Oct 22, 2026🔧 No Patch
CVE-2026-111949
CVSS 7.5high

miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding

Oct 21, 2026🔧 No Patch
CVE-2026-103895
CVSS 8.1high

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

Oct 16, 2026🔧 No Patch
CVE-2026-107433
CVSS 6.5medium

WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

Oct 14, 2026🔧 No Patch
CVE-2026-106610
CVSS 9.8critical

WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

Oct 10, 2026🔧 No Patch
CVE-2026-97274
CVSS 9.8EPSS 0%critical

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

Sep 30, 2026🔧 No Patch
CVE-2026-85984
CVSS 9.8critical

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter

Sep 26, 2026🔧 No Patch
CVE-2026-89027
CVSS 6.9medium

miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

Sep 15, 2026🔧 No Patch

Monitor miniorange in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

miniorange Security Vulnerabilities & Risk Score | 90 CVEs | SecAlerts - SecAlerts