Authentication Bypass
3 records27.3%First: 2023. Latest: 2026.
Plugin security history
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 11 vulnerability records associated with miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon, published between 2022 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
11Total records
2Critical
4High
5Medium
0Low
0Informational
10Patched records
1Currently marked unpatched
2022-09-23First disclosure
2026-07-24Latest disclosure
11 of 11CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2022 | 1 | |
| 2023 | 5 | |
| 2025 | 3 | |
| 2026 | 2 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 2 | 18.2% |
| High | 4 | 36.4% |
| Medium | 5 | 45.5% |
Vulnerability-Type Breakdown
Missing Authorization
2 records18.2%First: 2022. Latest: 2023.
Cross-Site Scripting
2 records18.2%First: 2023. Latest: 2026.
Other
2 records18.2%First: 2025. Latest: 2025.
CSRF
1 record9.1%First: 2023. Latest: 2023.
Privilege Escalation
1 record9.1%First: 2023. Latest: 2023.
Patch Status
- Patched
- 10
- Currently marked unpatched
- 1
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
7.8.17.8.07.7.0200.3.107.6.77.6.57.5.157.6.07.6.17.5.13
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-7.8.0 | miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | July 24, 2026 | 7.8.1 | Medium |
*-7.7.0 | miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow | July 10, 2026 | 7.8.0 | Critical |
*-7.7.0 | Social Login and Register <= 7.7.0 - Authenticated (Administrator+) Local File Inclusion | September 28, 2025 | Not supplied | Medium |
*-7.6.10 | WordPress Social Login and Register <= 7.6.10 - Unauthenticated Local File Inclusion | May 21, 2025 | 7.7.0 | High |
*-200.3.9 | miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass | March 7, 2025 | 200.3.10 | High |
*-7.6.6 | WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.6 - Authenticated (Subscriber+) Privilege Escalation | November 9, 2023 | 7.6.7 | High |
*-7.6.4 | WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass | June 28, 2023 | 7.6.5 | Critical |
*-7.5.14 | WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.5.14 - Cross-Site Request Forgery | February 15, 2023 | 7.5.15 | High |
*-7.5.14 | WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting | February 15, 2023 | 7.6.0 | Medium |
*-7.6.0 | WordPress Social Login and Register <= 7.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion | February 13, 2023 | 7.6.1 | Medium |
7.5.12 | WordPress Social Login and Register <=7.5.12 - Missing Authorization to Plugin Settings Update | September 23, 2022 | 7.5.13 | Medium |
Selected source records
Latest Records
MediumCVE-2026-65561
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: July 24, 2026
- Affected versions
- *-7.8.0
- Patched versions
- 7.8.1
CriticalCVE-2026-12761
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow
Published: July 10, 2026
- Affected versions
- *-7.7.0
- Patched versions
- 7.8.0
MediumCVE-2025-68974
Social Login and Register <= 7.7.0 - Authenticated (Administrator+) Local File Inclusion
Published: September 28, 2025
- Affected versions
- *-7.7.0
- Patched versions
- Not supplied
HighCVE-2025-47670
WordPress Social Login and Register <= 7.6.10 - Unauthenticated Local File Inclusion
Published: May 21, 2025
- Affected versions
- *-7.6.10
- Patched versions
- 7.7.0
HighCVE-2024-11087
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass
Published: March 7, 2025
- Affected versions
- *-200.3.9
- Patched versions
- 200.3.10
HighCVE-2023-47683
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.6 - Authenticated (Subscriber+) Privilege Escalation
Published: November 9, 2023
- Affected versions
- *-7.6.6
- Patched versions
- 7.6.7
CriticalCVE-2023-2982
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
Published: June 28, 2023
- Affected versions
- *-7.6.4
- Patched versions
- 7.6.5
MediumCVE-2023-23710
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: February 15, 2023
- Affected versions
- *-7.5.14
- Patched versions
- 7.6.0
Highest-Severity Records
CriticalCVE-2023-2982
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
Published: June 28, 2023
- Affected versions
- *-7.6.4
- Patched versions
- 7.6.5
CriticalCVE-2026-12761
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow
Published: July 10, 2026
- Affected versions
- *-7.7.0
- Patched versions
- 7.8.0
HighCVE-2023-47683
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.6 - Authenticated (Subscriber+) Privilege Escalation
Published: November 9, 2023
- Affected versions
- *-7.6.6
- Patched versions
- 7.6.7
HighCVE-2023-23706
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.5.14 - Cross-Site Request Forgery
Published: February 15, 2023
- Affected versions
- *-7.5.14
- Patched versions
- 7.5.15
HighCVE-2025-47670
WordPress Social Login and Register <= 7.6.10 - Unauthenticated Local File Inclusion
Published: May 21, 2025
- Affected versions
- *-7.6.10
- Patched versions
- 7.7.0
HighCVE-2024-11087
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass
Published: March 7, 2025
- Affected versions
- *-200.3.9
- Patched versions
- 200.3.10
MediumCVE-2025-68974
Social Login and Register <= 7.7.0 - Authenticated (Administrator+) Local File Inclusion
Published: September 28, 2025
- Affected versions
- *-7.7.0
- Patched versions
- Not supplied
MediumCVE-2023-24375
WordPress Social Login and Register <=7.5.12 - Missing Authorization to Plugin Settings Update
Published: September 23, 2022
- Affected versions
- 7.5.12
- Patched versions
- 7.5.13
Currently Marked Unpatched Records
MediumCVE-2025-68974
Social Login and Register <= 7.7.0 - Authenticated (Administrator+) Local File Inclusion
Published: September 28, 2025
- Affected versions
- *-7.7.0
- Patched versions
- Not supplied
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.