WPO365 | Login CVE-2026-96765

Exploitation requires the WPO365 | Login (Seamless WordPress + Microsoft Integration) plugin to be installed and active at version 44.1 or earlier, and the id_token-handling flow (Id_Token_Service) to be reachable by unauthenticated requests. The attacker must craft a forged id_token whose base64url-decoded unique_name or iss claim embeds malicious HTML; the payload is written to the wpo365_errors transient and persists up to three days. The key LIMITING factor is that the stored script only executes when a WordPress administrator subsequently visits the WPO365 wizard page - so successful impact depends on admin behavior within the transient's ~3-day lifetime, even though no prior authentication or classic victim interaction at injection time is needed.

This is a legitimately notable but not emergency-tier issue. CVSS 3.1 scores 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network-reachable, low complexity, and unauthenticated (PR:N), which is why the base score is elevated, and the changed scope (S:C) reflects that the injected script executes in a WordPress administrator's browser (a different security authority than the vulnerable component). However, several signals temper the raw score. No EPSS probability was provided in the input, and there is no CISA KEV listing and no public exploit code referenced - the only intelligence source is the Wordfence vulnerability advisory, so exploitation status is 'no public exploit identified at time of analysis.' Most importantly, the description's own mechanics conflict with the UI:N metric: the payload sits dormant in the wpo365_errors transient and only fires 'whenever a user accesses an injected page,' specifically when an administrator later visits the WPO365 wizard page. That required administrator visit is a real-world limiting factor the UI:N scoring does not capture - verify with vendor/Wordfence, but in practice this behaves closer to UI:R. The impact is also only Low/Low confidentiality and integrity (reflected/stored XSS in an admin context - session/token theft, CSRF-style admin actions), not full RCE. Net: a credible stored-XSS admin-takeover vector worth patching promptly on affected sites, but not a mass-exploited, automatable crisis absent any KEV/EPSS/POC signal.

An unauthenticated attacker sends a crafted request to a WPO365-enabled WordPress site with a forged id_token whose base64url-decoded unique_name or iss claim contains a malicious HTML/JavaScript payload. The token processing stores this payload in the wpo365_errors transient (persisting up to three days), and when a site administrator subsequently opens the WPO365 wizard page, the script executes in their authenticated browser session - enabling session/cookie theft or administrative actions. No public exploit code is referenced, but the attack requires only a single crafted unauthenticated HTTP request and the source references pinpoint the vulnerable code paths.