CVE-2026-61957
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
XSS vulnerability in miniorange otp verification up to version 5.5.1. An unauthenticated attacker can inject malicious JavaScript.
Risk Assessment
Risk includes session theft, redirection to malicious sites, or theft of sensitive data.
Recommendation
Update the miniorange otp verification plugin to the latest version.
Other vulnerabilities in miniorange otp verification
See all- CVE-2026-61967Critical
Unauthenticated Privilege Escalation vulnerability in miniorange otp verification versions up to 5.5.1. An attacker can gain higher privileges without authentication.
- CVE-2026-42731Critical
CVE-2026-42731 describes an incorrect privilege assignment vulnerability in miniOrange OTP Verification that allows privilege escalation. This issue affects versions from n/a through 5.4.9 inclusive.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.