Cyberlord92 vulnerabilities
We track 23 vulnerabilities in Cyberlord92 products across 14 products. 23 are rated high or critical, and none are known to be exploited. The most recent was published on October 16, 2026.
Latest Cyberlord92 vulnerabilities
- 8.1 High severity
miniOrange OTP Login, Verification and SMS…: Improper Authentication
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the
- 9.8 Critical severity
miniOrange OTP Login, Verification and SMS…: Improper Authentication
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the ski
- 7.5 High severity
SAML Single Sign On – SSO Login: Improper Authentication
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLRes
- 7.5 High severity
Page and Post Restriction: Missing Authorization
The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/<id>, /wp-json/wp/v2/posts, and /wp-json/w
- 9.8 Critical severity
SAML Single Sign On – SSO Login: Improper Authentication
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer
- 9.8 Critical severity
SAML Single Sign On – SSO Login: Improper Verification of Cryptographic Signature
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads t
- 9.8 Critical severity
miniOrange Social Login and Register (Discord…: Improper Authentication
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an
- 9.8 Critical severity
miniOrange OTP Login, Verification and SMS…: Missing Authorization
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()
- 9.8 Critical severity
All-in-One Microsoft 365 & Entra ID / Azure AD…: Authentication Bypass Using an Alternate Path or Channel
The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as ot
- 9.8 Critical severity
OAuth Single Sign On – SSO (OAuth Client): Improper Verification of Cryptographic Signature
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verificatio
- 8.1 High severity
Miniorange OTP Verification with Firebase: Missing Authorization
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofirebase_form_options' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated a
- 8.1 High severity
Campus Directory – Faculty, Staff & Student…: Improper Neutralization of Directives in Dynamically Evaluated Code
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input b
- 9.8 Critical severity
miniOrange Social Login and Register (Discord…: Improper Authentication
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being return
- 7.5 High severity
Page and Post Restriction: Exposure of Sensitive Information to an Unauthorized Actor
The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for unauthenticated attac
- 8.1 High severity
OAuth Single Sign On – SSO (OAuth Client): Improper Authentication
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is due to insufficient verification on the user being returned by the social login token. This makes it
- 7.2 High severity
SAML IDP (Identity Provider) – Login with…: Improper Neutralization of Special Elements used in an SQL Command
The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of suffic
- 9.8 Critical severity
Miniorange OTP Verification with Firebase: Incorrect Privilege Assignment
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for un
- 9.8 Critical severity
Miniorange OTP Verification with Firebase: Authorization Bypass Through User-Controlled Key
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorizati
- 8.1 High severity
Miniorange OTP Verification with Firebase: Missing Authentication for Critical Functionality
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes
- 9.8 Critical severity
Web Application Firewall – website security: Missing Critical Step in Authentication
The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malwa
- 9.8 Critical severity
Web3 – Crypto wallet Login & NFT token gating: Authentication Bypass Using an Alternate Path or Channel
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible f
- 7.5 High severity
Active Directory Integration / LDAP Integration: Improper Neutralization of Special Elements used in an LDAP Query
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an
- 9.8 Critical severity
miniOrange Social Login and Register (Discord…: Authentication Bypass Using an Alternate Path or Channel
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login v