Die 1 veröffentlichte Version hat alle Prüfungen bestanden
Jede Version wird bereinigt, mit dem Lizenzcode des Anbieters verglichen und gescannt, bevor sie committet wird. Eine Version, die die Prüfung nicht besteht, wird nicht veröffentlicht. Letzter Scan .
Zurückgehalten: Archive dieses Plugins, die die automatischen Prüfungen nicht bestanden haben und nicht veröffentlicht werden. Geprüfte Funde: Treffer der Regeln, die vor der Veröffentlichung geprüft und geklärt wurden.
Web-Shells, verschleierte Loader, kodiertes PHP und bekannte Nulling-Muster (php-malware-finder plus MeteorGPL-Regeln).
PHP-AnalyseHeuristik v20
Analyse auf Token-Ebene: Remote-Includes, Request-Eingaben, die Shell-Funktionen erreichen, Decoder, die eval speisen, in Bildern, Schriften oder Archiven verstecktes PHP, Überschreibungen von Server-Handlern.
LizenzintegritätSignatursatz 294436f328f6
Lizenz-, Aktivierungs- und Update-Code wird mit dem eigenen Code des Anbieters und der vorherigen Version verglichen; veränderter Lizenzcode wird nie veröffentlicht.
PHP-SyntaxPHP 8.3.36
Jede PHP-Datei lässt sich mit der PHP-Version parsen, die das Repository unterstützt.
Grafiken, Schriften, Medien und Demo-Inhalte, die möglicherweise separat lizenziert sind, werden durch Platzhalter ersetzt oder entfernt (Lizenzprofil gpl-full).
Eine Sicherheitslücke melden. Sicherheitsprobleme im eigenen Code des Plugins sind Sache des Anbieters miniOrange; melden Sie sie dort. Probleme mit einem Paket, wie es dieses Repository verbreitet – eine Datei, die nicht dort sein sollte, ein Scan, der etwas übersehen hat –, gehen an packages@meteorgpl.com und werden innerhalb von 48 Stunden beantwortet.
Was bei einem Fund geschieht. Die betroffenen Versionen werden aus dem Repository zurückgezogen, die Beobachter des Pakets werden benachrichtigt, und eine korrigierte Version wird veröffentlicht, sobald eine alle Prüfungen besteht.
Rechteinhaber. Die Takedown-Richtlinie beschreibt, wie ein Paket entfernt wird.
Bekannte Schwachstellen
Öffentliche Schwachstellenmeldungen zu Social Login, Social Sharing by miniOrange, die betroffenen Versionen und die Version in diesem Repository, die sie behebt. Beobachter des Pakets und Konten, die bekanntermaßen eine betroffene Version einsetzen, werden benachrichtigt.
Der Anbieter hat sie in 7.9.0 behoben; diese Version ist noch nicht im Repository.
1 Version in diesem Repository ist betroffen: 7.6.9
Details
The Social Login, Social Sharing by miniOrange plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.8.2. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Abhilfe: Update to version 7.9.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Der Anbieter hat sie in 7.8.2 behoben; diese Version ist noch nicht im Repository.
1 Version in diesem Repository ist betroffen: 7.6.9
Details
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.8.1. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Abhilfe: Update to version 7.8.2, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Der Anbieter hat sie in 7.8.1 behoben; diese Version ist noch nicht im Repository.
1 Version in diesem Repository ist betroffen: 7.6.9
Details
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Abhilfe: Update to version 7.8.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Der Anbieter hat sie in 7.8.0 behoben; diese Version ist noch nicht im Repository.
1 Version in diesem Repository ist betroffen: 7.6.9
Details
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with send_otp_token() returning the SHA-512(customer_key || otp) transaction hash to the client where the OTP space is only 99,000 values (wp_rand(1000, 99999)) and the customer_key is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to mo_openid_social_login_validate_otp(), which logs the attacker in as the user whose email was supplied — granting full administrator access.
Abhilfe: Update to version 7.8.0, or a newer patched version
Der Anbieter hat sie in 7.8.0 behoben; diese Version ist noch nicht im Repository.
1 Version in diesem Repository ist betroffen: 7.6.9
Details
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to Privilege Escalation in all versions up to 7.8.0 (exclusive). This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
Abhilfe: Update to version 7.8.0, or a newer patched version
1 Version in diesem Repository ist betroffen: 7.6.9
Details
The Social Login and Register plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 7.7.0. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
Abhilfe: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program
Der Anbieter hat sie in 7.7.0 behoben; diese Version ist noch nicht im Repository.
1 Version in diesem Repository ist betroffen: 7.6.9
Details
The WordPress Social Login and Register plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 7.6.10. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Abhilfe: Update to version 7.7.0, or a newer patched version
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program
Der Anbieter hat sie in 200.3.10 behoben; diese Version ist noch nicht im Repository.
1 Version in diesem Repository ist betroffen: 7.6.9
Details
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
Abhilfe: Update to version 200.3.10, or a newer patched version
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 7.6.6. This is due to the plugin improperly restricting user meta values that can be updated and allowing users to control a user role update during a social login through the custom registration form. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator. We believe that this vulnerability requires the Custom Registration Add-on to be enabled, however, this is simply based on our assessment with the limited information available.
Abhilfe: Update to version 7.6.7, or a newer patched version
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
Abhilfe: Update to version 7.6.5, or a newer patched version
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 7.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Abhilfe: Update to version 7.6.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.5.14. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to trigger requests on behalf of an administrator, granted they can trick a site administrator into performing an action such as clicking on a link.
Abhilfe: Update to version 7.5.15, or a newer patched version
The WordPress Social Login and Register plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.6.0. This is due to a missing capability check on the 'mo_openid_login_validate' (and possibly 'end_new_tour2' and 'mo_openid_show_apps') functions. This makes it possible for unauthenticated attackers to delete social profile data and potentially perform other tasks.
Abhilfe: Update to version 7.6.1, or a newer patched version
The WordPress Social Login and Register plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the mo_sharing_app_value function as well as others that are reachable via AJAX action in versions up to, and including, 7.5.12. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change plugin settings.
Additionally, some AJAX actions were missing nonce checks thus making them vulnerable to Cross-Site Request Forgery. This enables unauthenticated attackers to invoke the corresponding functions, granted they can trick an administrator into performing an action such as clicking on a link.
Abhilfe: Update to version 7.5.13, or a newer patched version
Schwachstellendaten: Wordfence Intelligence. Jede Sicherheitsmeldung verweist auf ihren Eintrag dort.
Copyright 2012-2026 Defiant Inc.. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. https://www.cve.org/Legal/TermsOfUse
