https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 07:42:45 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342760 EUVD-2026-342760 https://cve.radiocsirt.org/vuln/euvd-2026-342760 https://cve.radiocsirt.org/vuln/fkie_cve-2026-14300 <p>The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim&#39;s email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.</p> <p>The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim&#39;s email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-14300 https://cve.radiocsirt.org/vuln/ghsa-6xgh-57mv-pxm7 <p>The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim&#39;s email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.</p> <p>The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim&#39;s email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.</p> https://cve.radiocsirt.org/vuln/ghsa-6xgh-57mv-pxm7