CVE-2026-96765

Name of the Vulnerable Software and Affected Versions WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) versions prior to 44.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. By submitting a crafted request with a forged id token parameter, where the base64url-decoded unique name or iss claims contain malicious HTML, an attacker can store a payload in the wpo365 errors transient for up to three days. The script executes when an administrator visits the WPO365 wizard page.

Recommendations Update WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) to version 44.2 or later.