WP Vulnerability WatchVulnerability data as of September 23, 2026

Known vulnerabilities in Headless SSO Plugin for WP

Headless SSO Plugin allows SSO login into any frontend application React, Flutter, Angular, Gatsby, etc via WordPress and Identity Providers.

3Reported vulnerabilities
8.1Highest CVSS score
1.6.1Latest version
10+Active installs

What to do now

Update Headless SSO Plugin for WP to 1.7.1 or later. 3 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 30, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2026-28149 High 8.1 0.4% 1.6 and earlier 1.6.1 August 12, 2026
CVE-2026-62108 High 7.3 0.4% 1.7.0 and earlier 1.7.1 September 15, 2026
CVE-2026-28148 Medium 5.3 0.2% 1.6 and earlier 1.6.1 August 12, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.