CVE-2026-82183

The OAuth Single Sign On WordPress plugin (versions 6.25.0 - 7.0.0) is vulnerable to unauthenticated account takeover because it fails to verify the identity assertion returned during the Steam single sign-on flow . This flaw allows unauthenticated attackers to log in as any arbitrary non-adminis...

CVE-2026-28008 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...

CVE-2025-10753

The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality accessible via the 'oauthredirect' opti...