Wpo365
10 CVEs in 6 Wpo365 products, including Wpo365 | Seamless WordPress + Microsoft Integration (Wpo365 | Login), WordPress \+ Azure Ad \/ Microsoft Office 36…
Wpo365 products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-122220 | High | 7.4 | 2026-11-04 | WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-repl… |
CVE-2026-107759 | High | 7.2 | 2026-10-31 | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 you… |
CVE-2026-96765 | High | 7.2 | 2026-10-10 | The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' p… |
CVE-2026-104759 | High | 8.1 | 2026-10-10 | The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in a… |
CVE-2026-15212 | High | 8.8 | 2026-07-23 | The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::ve… |
CVE-2025-1488 | Medium | 4.7 | 2025-02-24 | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insuffici… |
CVE-2024-4706 | Medium | 6.4 | 2024-05-23 | The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode i… |
CVE-2023-32119 | Medium | 5.8 | 2023-08-23 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPO365 | Mail Integration for Office 365 / Outlook plugin <= 1.9.0 versions. |
CVE-2021-43409 | Critical | 9.3 | 2021-11-19 | The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (… |
CVE-2020-26511 | High | 7.5 | 2020-10-02 | The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass. |