63 matches found
CVE-2026-104759
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to an Authentication Bypass in versions up to and including 44.1 . The root cause is located in Id_Token_Service_Deprecated::process_openidconnect_token(), which utilizes the incompatible W...
EUVD-2026-96286
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to IdTokenServiceDeprecated::processopenidconnecttoken using the incompatible WordPress...
CVE-2026-96765
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 44.1 . The root cause is insufficient input sanitization and output escaping of the id_token paramet...
EUVD-2026-96281
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'idtoken' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin <= 44.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin WPO365 versions = 44.1...
WordPress WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin <= 44.1 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Wordfence PRISM in WordPress Plugin WPO365 versions = 44.1...
CVE-2026-102915
Subscriber Broken Access Control in WPO365 = 44.1 versions...
EUVD-2026-93071
Subscriber Broken Access Control in WPO365 = 44.1 versions...
CVE-2026-102915 WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPO365 = 44.1 versions...
CVE-2026-102915
The WPO365 plugin for WordPress (versions
CVE-2026-102915 WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPO365 = 44.1 versions...
PT-2026-106369
Subscriber Broken Access Control in WPO365 = 44.1 versions...
WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Michał Wiencek in WordPress Plugin WPO365 versions = 44.1...
CVE-2026-15212
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...
CVE-2026-15212
CVE-2026-15212 affects the WPO365 | Login plugin for WordPress (up to version 43.2). The root cause is that Ajax_Service::verify_ajax_request() gates wp_verify_nonce() behind the boolean option enable_nonce_check, which is missing from the default wpo365_options. This causes wp_ajax_wpo365_update...
CVE-2026-15212 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...
WordPress WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin <= 43.2 - Cross-Site Request Forgery to Privilege Escalation vulnerability
Cross-Site Request Forgery to Privilege Escalation vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin WPO365 versions = 43.2...
CVE-2026-15212: Cross-Site Request Forgery (CSRF)
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the AjaxService::verifyajaxrequest helper gating its wpverifynonce call behind the boolean option 'enablenoncecheck', which is absent from the default...
PT-2026-64159
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax Service::verify ajax request helper gating its wp verify nonce call behind the boolean option 'enable nonce check', which is absent from the default...
