Read the docs

wpo365

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

wpo365 records in CISA KEV

No wpo365 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wordpress + Azure Ad / Microsoft Office 365 2 records MEDIUM Mail Integration For Office 365 / Outlook 1 record LOW Microsoft 365 Graph Mailer 1 record LOW

Records

10 records

TI-2021-19351 CVE-2021-43409 · GHSA-px36-5x6h-5x8g

WPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site Scripting

Priority MEDIUM 42

The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS).

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00968 Published 2021-11-19 Fixed in 15.3 CWE-79
TI-2026-85151 CVE-2026-122220 · GHSA-72vv-ff63-gjjc

Authentication bypass via SAML replay in WPO365 LOGIN plugin

Priority MEDIUM 41

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never pe…

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00329 Published 2026-11-04 Fixed in 45.2 CWE-294
TI-2026-70259 CVE-2026-104759 · GHSA-p38j-g4g4-fm3g

Authentication bypass in WPO365 WordPress plugin via OIDC nonce replay

Priority LOW 38

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Tok…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00515 Published 2026-10-10 No fix listed CWE-287
TI-2026-70212 CVE-2026-96765 · GHSA-87pp-p526-6wm7

Stored cross-site scripting in WPO365 Login WordPress plugin

Priority LOW 32

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to in…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00321 Published 2026-10-10 No fix listed CWE-79
TI-2026-83509 CVE-2026-107759 · GHSA-jg4v-r26p-p7r2

Stored cross-site scripting in WPO365 Microsoft 365 Graph Mailer

Priority LOW 31

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00272 Published 2026-10-31 No fix listed CWE-79
TI-2024-04379 CVE-2024-4706 · GHSA-mgrf-rx3w-m492

Cross-site scripting in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION

Priority LOW 28

The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00273 Published 2024-05-23 No fix listed CWE-79
Open these records in search →