CVE-2026-14300
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The miniOrange Social Login and Register WordPress plugin before 7.8.0 does not bind the one-time code used for optional email verification to the account it was issued for. This allows an unauthenticated attacker to obtain a valid session for any account, including administrators, by requesting a code for a controlled email and replaying it against the victim's email.
Risk Assessment
An attacker can hijack an administrator account, gaining full control over the WordPress site, leading to data theft and further attacks.
Recommendation
Update the miniOrange Social Login and Register plugin to version 7.8.0 or later.
Other vulnerabilities in WordPress plugin
See all- CVE-2026-14234High
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions. This allows an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting (XSS).
- CVE-2026-13690High
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler. This allows an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.
- CVE-2026-13605Medium
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption written into the page DOM without escaping. An authenticated user with Author-level access can store a JavaScript payload that executes in any visitor's browser, including an administrator, who clicks the link.
- CVE-2026-11351Medium
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints. This allows unauthenticated users to retrieve information about non-published WooCommerce products (e.g., draft, pending, or private).
Original NVD description (English source)
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.