miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site Scripting
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
Why it matters now
EPSS 0.00587 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed miniOrange's Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login (Unknown): 5.5.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | miniOrange's Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login | 5.5.6 to before 5.5.6 | 5.5.6 | Patch available | CNA |
- miniOrange's Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login VendorUnknown Affected 5.5.6 to before 5.5.6 Fixed in 5.5.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:miniorange:google_authenticator:*:*:*:*:*:wordpress:*:* | before 5.5.6 | Vulnerable | miniOrange |
- cpe:2.3:a:miniorange:google_authenticator:*:*:*:*:*:wordpress:*:* Versions before 5.5.6 Vulnerable ·miniOrange
Remediation
- Fix · CNA miniOrange's Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login (Unknown) Fixed in 5.5.6
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1321
- 2026-10-03 Alias added: GHSA-fx6c-r92h-hc9p
References
More miniOrange Google Authenticator vulnerabilities
- TI-2022-04534 miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change CVSS 3.1HIGH 7.5
- TI-2022-20660 WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2022-21926 WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure CVSS 3.1HIGH 8.1
- TI-2022-00165 miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion CVSS 3.1HIGH 8.1
- TI-2022-00780 miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.3
Sources
- CVE-2022-1321 · CVE Program
- CVE-2022-1321 · NVD
- FIRST EPSS
- GHSA-fx6c-r92h-hc9p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences