Live › vulnerability › CVE-2026-107759
The WPO365 Microsoft 365 Graph Mailer WordPress plugin, up to and including 6.2, does not sanitize the mail subject passed through wp_mail, so a Contact Form 7 submitter can store a script. The script runs in the browser of any user who opens the affected page, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 08:34 UTC. All times on this page are UTC.
WordPress sites running the WPO365 Graph Mailer plugin at version 6.2 or lower, with Graph Mailer enabled. The payload is stored without login when OAuth authorization is incomplete, which the sources describe as the default state right after activation. Sites that do not use Graph Mailer or that have completed OAuth authorization are not described as exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WPO365 | MICROSOFT 365 GRAPH MAILER (wpo365-msgraphmailer) | wordpress | <= 6.2 | 6.3 |
6.2 or lower.your-subject field.Security: Fixed a cross-site scripting (XSS) vulnerability and hardened mail authorization, but does not name this CVE or the mail subjectEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation.
This page as .md · .json · in your agent: get_signal("CVE-2026-107759")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.