CVE-2026-107759

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject via wpmail/PHPMailer, e.g. CF7 your-subject' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107759

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.2 . The root cause is insufficient input sanitization and output escaping of the 'Subject' parameter passed via wp_mail/PHPMailer (e.g., from a Con...

EUVD-2026-114654

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject via wpmail/PHPMailer, e.g. CF7 your-subject' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107759 WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject via wpmail/PHPMailer, e.g. CF7 your-subject' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107759: wpo365 WPO365 | MICROSOFT 365 GRAPH MAILER: The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject via wpmail/PHPMailer, e.g. CF7 your-subject' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it...

WordPress WPO365 | MICROSOFT 365 GRAPH MAILER plugin <= 6.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nick Verhelle Bulldawg in WordPress Plugin WPO365 | MICROSOFT 365 GRAPH MAILER versions = 6.2...

CVE-2026-96765

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'idtoken' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104759

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to IdTokenServiceDeprecated::processopenidconnecttoken using the incompatible WordPress...

CVE-2026-104759 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to IdTokenServiceDeprecated::processopenidconnecttoken using the incompatible WordPress...

EUVD-2026-96286

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to IdTokenServiceDeprecated::processopenidconnecttoken using the incompatible WordPress...

CVE-2026-104759 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to IdTokenServiceDeprecated::processopenidconnecttoken using the incompatible WordPress...

CVE-2026-104759

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to an Authentication Bypass in versions up to and including 44.1 . The root cause is located in Id_Token_Service_Deprecated::process_openidconnect_token(), which utilizes the incompatible W...

EUVD-2026-96281

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'idtoken' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96765 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'idtoken' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96765 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'idtoken' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96765

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 44.1 . The root cause is insufficient input sanitization and output escaping of the id_token paramet...

CVE-2026-96765: Improper Neutralization of Input During Web Page Generation

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'idtoken' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104759: Improper Authentication

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to IdTokenServiceDeprecated::processopenidconnecttoken using the incompatible WordPress...

PT-2026-109600

Name of the Vulnerable Software and Affected Versions WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION versions prior to 44.2 Description An authentication bypass exists due to an OIDC Nonce Replay flaw. The Id Token Service Deprecated::process openidconnect token function uses the wp verify...

PT-2026-109608

Name of the Vulnerable Software and Affected Versions WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN versions prior to 44.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique...