Wpo365 Login Vulnerabilities

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attack...

CVSS:

7.2

(Wordfence)

Affected:

up to 44.1

Fixed in:

45.0

Disclosed:

Oct 9, 2026

CVE-2026-96765 on NVD →

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_veri...

CVSS:

8.1

(Wordfence)

Affected:

up to 44.1

Fixed in:

45.0

Disclosed:

Oct 9, 2026

CVE-2026-104759 on NVD →

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 44.1. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with subscriber-level access and abo...

CVSS:

4.3

(Wordfence)

Affected:

up to 44.1

Fixed in:

45.0

Disclosed:

Oct 5, 2026

CVE-2026-102915 on NVD →

The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' ar...

CVSS:

8.8

(Wordfence)

Affected:

up to 43.2

Fixed in:

43.3

Disclosed:

Jul 23, 2026

CVE-2026-15212 on NVD →

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 40.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations o...

CVSS:

6.4

(Wordfence)

Affected:

up to 40.0

Fixed in:

40.1

Disclosed:

Jan 21, 2026

CVE-2025-67961 on NVD →

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for auth...

CVSS:

6.4

(Wordfence)

Affected:

up to 27.2

Fixed in:

28.0

Disclosed:

May 22, 2024

CVE-2024-4706 on NVD →

The WPO365 | LOGIN WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handl...

CVSS:

6.1

(Wordfence)

Affected:

up to 15.3

Fixed in:

15.4

Disclosed:

Oct 15, 2021

CVE-2021-43409 on NVD →

The WPO365 | LOGIN plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.

CVSS:

9.1

(Wordfence)

Affected:

up to 11.6

Fixed in:

11.7

Disclosed:

Oct 2, 2020

CVE-2020-26511 on NVD →