Wpo365
Monthly
Stored cross-site scripting in the WPO365 | Microsoft 365 Graph Mailer WordPress plugin, affecting all versions up to and including 6.2, lets unauthenticated attackers plant arbitrary script in a mail subject that is stored and later rendered back to a viewer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) reflects unauthenticated network reach with a scope change and limited confidentiality and integrity impact. Exploitation is conditional: the Graph Mailer must be enabled while OAuth authorization has not been completed - the default state right after activation - and the site must expose a mail-sending feature that forwards a submitter-controlled subject, such as a public Contact Form 7 form; the injected script only runs when a user, likely an administrator reviewing the mail log or the affected page, actually opens it. No confirmed public exploit code and no CISA KEV listing were identified at time of analysis; the vuln.today decision label is this_week, so this is a moderate-but-real priority rather than an emergency.
Replaying a previously-issued OIDC id_token allows unauthenticated attackers to bypass authentication in WPO365 Login (≤44.1) and take over any WordPress account, including administrators. The flaw is gated by the non-default use_id_token_parser_v2 option and requires a valid id_token for the target account. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WPO365 | Login (Seamless WordPress + Microsoft Integration) plugin for WordPress, affecting all versions up to and including 44.1, lets unauthenticated remote attackers inject arbitrary HTML/JavaScript that is persisted for up to three days. A forged 'id_token' whose base64url-decoded unique_name or iss claim carries malicious markup survives the plugin's token-to-error logging path (Id_Token_Service) and lands in the wpo365_errors transient with no sanitization on input and no escaping on output, so the injected script executes when a WordPress administrator later opens the WPO365 wizard page. Because the assessed vector is PR:N/UI:R, no credentials are needed to plant the payload, but the attacker is dependent on an administrator visiting the affected admin screen inside the transient's roughly three-day window; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the vendor has shipped a fixed release (45.0). Impact is bounded to low confidentiality and integrity within the WordPress admin context (no availability impact), which makes this a legitimately notable but not emergency-tier issue.
Broken access control in the WPO365 WordPress plugin through version 44.1 lets an authenticated Subscriber-level account reach data or functionality beyond its assigned role, with the CVSS 3.1 vector indicating high confidentiality impact and a scope change. Exploitation is network-reachable and low-complexity requiring only a low-privilege account, with no user interaction needed; however, sites that disable self-registration or have no untrusted low-tier users substantially limit exposure. The CVE carries a HIGH base score of 8.5, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Privilege escalation via Cross-Site Request Forgery affects the WPO365 | Login plugin for WordPress (versions up to and including 43.2), where an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can overwrite arbitrary plugin options and seize control of the site. The root cause is that the AJAX settings handler's nonce check is gated behind an 'enable_nonce_check' option that is absent from the default configuration, so it silently evaluates to false and no CSRF protection runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technical write-up from Wordfence is detailed enough to make reproduction straightforward, and the 8.8 CVSS reflects the full-takeover potential.
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Stored cross-site scripting in the WPO365 | Microsoft 365 Graph Mailer WordPress plugin, affecting all versions up to and including 6.2, lets unauthenticated attackers plant arbitrary script in a mail subject that is stored and later rendered back to a viewer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) reflects unauthenticated network reach with a scope change and limited confidentiality and integrity impact. Exploitation is conditional: the Graph Mailer must be enabled while OAuth authorization has not been completed - the default state right after activation - and the site must expose a mail-sending feature that forwards a submitter-controlled subject, such as a public Contact Form 7 form; the injected script only runs when a user, likely an administrator reviewing the mail log or the affected page, actually opens it. No confirmed public exploit code and no CISA KEV listing were identified at time of analysis; the vuln.today decision label is this_week, so this is a moderate-but-real priority rather than an emergency.
Replaying a previously-issued OIDC id_token allows unauthenticated attackers to bypass authentication in WPO365 Login (≤44.1) and take over any WordPress account, including administrators. The flaw is gated by the non-default use_id_token_parser_v2 option and requires a valid id_token for the target account. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WPO365 | Login (Seamless WordPress + Microsoft Integration) plugin for WordPress, affecting all versions up to and including 44.1, lets unauthenticated remote attackers inject arbitrary HTML/JavaScript that is persisted for up to three days. A forged 'id_token' whose base64url-decoded unique_name or iss claim carries malicious markup survives the plugin's token-to-error logging path (Id_Token_Service) and lands in the wpo365_errors transient with no sanitization on input and no escaping on output, so the injected script executes when a WordPress administrator later opens the WPO365 wizard page. Because the assessed vector is PR:N/UI:R, no credentials are needed to plant the payload, but the attacker is dependent on an administrator visiting the affected admin screen inside the transient's roughly three-day window; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the vendor has shipped a fixed release (45.0). Impact is bounded to low confidentiality and integrity within the WordPress admin context (no availability impact), which makes this a legitimately notable but not emergency-tier issue.
Broken access control in the WPO365 WordPress plugin through version 44.1 lets an authenticated Subscriber-level account reach data or functionality beyond its assigned role, with the CVSS 3.1 vector indicating high confidentiality impact and a scope change. Exploitation is network-reachable and low-complexity requiring only a low-privilege account, with no user interaction needed; however, sites that disable self-registration or have no untrusted low-tier users substantially limit exposure. The CVE carries a HIGH base score of 8.5, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status.
Privilege escalation via Cross-Site Request Forgery affects the WPO365 | Login plugin for WordPress (versions up to and including 43.2), where an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can overwrite arbitrary plugin options and seize control of the site. The root cause is that the AJAX settings handler's nonce check is gated behind an 'enable_nonce_check' option that is absent from the default configuration, so it silently evaluates to false and no CSRF protection runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technical write-up from Wordfence is detailed enough to make reproduction straightforward, and the 8.8 CVSS reflects the full-takeover potential.
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.