https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T07:42:50.077284+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-14300 CVE-2026-14300 — miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover 2026-10-12T07:42:50.092752+00:00

Affected: Unknown miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.