WordPress security by component
miniorange otp verification
Plugin description
miniorange otp verification is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
miniorange-otp-verificationLatest vulnerability
CVE-2026-61957: miniOrange OTP Verification public input permits cross-site scripting
miniOrange OTP Verification through 5.5.1 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-61957
miniOrange OTP Verification public input permits cross-site scripting
miniOrange OTP Verification through 5.5.1 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.
|
5.5.2 |
CVE7.1
NVDPending
|
| Jul 09, 2026 |
CVE-2026-14245
miniOrange OTP Login, Verification and SMS Notifications: Privilege escalation or authentication bypass
miniOrange OTP Login, Verification and SMS Notifications is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 5.5.1.
|
> 5.5.1 |
CVE9.8
NVDPending
|
| May 27, 2026 |
CVE-2026-42731
miniorange otp verification: Privilege escalation or authentication bypass
miniorange otp verification is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 5.4.9.
|
5.5.0 |
CVE9.8
NVDPending
|
| Dec 09, 2024 |
CVE-2023-47776
miniorange otp verification: A security weakness
miniorange otp verification is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|