Plugin icon

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)

wpo365-login

Vulnerabilities:

8

Last Updated:

October 4, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-10-09
Title
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) < 45.0 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
Fixed in
Fixed in 45.0
CVSS
7.2 (high)
Published
2026-10-09
Title
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) < 45.0 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
Fixed in
Fixed in 45.0
CVSS
8.1 (high)
Published
2026-10-05
Title
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) < 45.0 - Missing Authorization
Fixed in
Fixed in 45.0
CVSS
4.3 (medium)
Published
2026-07-23
Title
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) < 43.3 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
Fixed in
Fixed in 43.3
CVSS
8.8 (high)
Published
2026-01-21
Title
WPO365 < 40.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Fixed in
Fixed in 40.1
CVSS
6.4 (medium)
Published
2024-05-22
Title
WordPress + Microsoft Office 365 / Azure AD | LOGIN < 28.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode
Fixed in
Fixed in 28.0
CVSS
6.4 (medium)
Published
2021-10-15
Title
WordPress + Microsoft Office 365 < 15.4 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 15.4
CVSS
9.6 (critical)
Published
2020-10-02
Title
WordPress + Microsoft Office 365 < 11.7 - JWT Signature Verification Bypass
Fixed in
Fixed in 11.7
CVSS
7.2 (high)