{"id":"CVE-2026-107759","kind":"vulnerability","aliases":["CVE-2026-107759"],"related":[],"title":"WPO365 Graph Mailer WordPress plugin: unauthenticated stored XSS via mail subject","description":"The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation.","summary":"The WPO365 Microsoft 365 Graph Mailer WordPress plugin, up to and including 6.2, does not sanitize the mail subject passed through wp_mail, so a Contact Form 7 submitter can store a script. The script runs in the browser of any user who opens the affected page, including administrators.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WPO365 | MICROSOFT 365 GRAPH MAILER (wpo365-msgraphmailer)","fixed":["6.3"],"affected":"<= 6.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["contact-form-7","microsoft-365","package","wordpress","wp-plugin"],"not_affected_if":["graph-mailer-disabled","oauth-completed","plugin-not-installed"],"how_to_check":"- Check whether the WPO365 Graph Mailer plugin is installed and its version is `6.2` or lower.\n- Check whether Graph Mailer is enabled while OAuth authorization has not been completed.\n- Check whether a contact or mail form forwards a visitor-supplied subject, such as a Contact Form 7 `your-subject` field.","fix":"Update WPO365 Graph Mailer to 6.3 (released 2026-10-18), the current wordpress.org version. Its changelog lists 'Security: Fixed a cross-site scripting (XSS) vulnerability' and hardened mail authorization, but does not name this CVE or the mail subject. Version 6.2 also claimed an XSS fix and is still listed as affected.","status":"open","published_at":"2026-10-31T08:16:48+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","triaged_at":"2026-10-31T08:35:05+00:00","updated_at":"2026-10-31T08:36:08+00:00","category":"package","confidence":0.65,"triage":{"at":"2026-10-31T08:35:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WPO365 Graph Mailer WordPress plugin: unauthenticated stored XSS via mail subject","impact":"medium","summary":"The WPO365 Microsoft 365 Graph Mailer WordPress plugin, up to and including 6.2, does not sanitize the mail subject passed through wp_mail, so a Contact Form 7 submitter can store a script. The script runs in the browser of any user who opens the affected page, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","contact-form-7","microsoft-365"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed version and any vendor remediation from the NVD entry or the plugin's changelog; sources given do not state a fix.","how_to_check":"- Check whether the WPO365 Graph Mailer plugin is installed and its version is `6.2` or lower.\n- Check whether Graph Mailer is enabled while OAuth authorization has not been completed.\n- Check whether a contact or mail form forwards a visitor-supplied subject, such as a Contact Form 7 `your-subject` field.","plain_action":"","needs_analyst":true,"not_affected_if":["graph-mailer-disabled","oauth-completed","plugin-not-installed"],"who_is_affected":"WordPress sites running the WPO365 Graph Mailer plugin at version 6.2 or lower, with Graph Mailer enabled. The payload is stored without login when OAuth authorization is incomplete, which the sources describe as the default state right after activation. Sites that do not use Graph Mailer or that have completed OAuth authorization are not described as exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4306,"output_tokens":673,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor remediation from the NVD entry or the plugin's changelog; sources given do not state a fix.","search":"'-107759':14A,17A '-2026':13A,16A '-365':31B '365':20A,40B,89C '6.2':49B,122C '7':29B,64B,178C 'access':151C 'activ':199C 'administr':85B 'affect':82B 'arbitrari':140C 'attack':137C 'authent':160C 'author':188C 'browser':75B 'cf7':110C 'complet':192C 'contact':27B,62B,176C 'contact-form':26B 'control':172C 'cross':100C 'cross-sit':99C 'cve':12A,15A 'default':194C 'due':123C 'e.g':109C,174C 'enabl':185C 'escap':130C 'execut':147C 'featur':166C 'form':28B,63B,177C,179C 'forward':168C 'graph':2A,21A,41B,90C,182C 'immedi':196C 'includ':48B,84B,121C 'inject':139C,153C 'input':126C 'insuffici':125C 'mail':10A,54B,59B,164C 'mail-send':163C 'mail/phpmailer':108C 'mailer':3A,22A,42B,91C,183C 'make':132C 'microsoft':19A,30B,39B,88C 'msgraphmailer':25A 'oauth':187C 'open':80B 'output':129C 'packag':32B 'page':83B,144C,154C 'paramet':114C 'pass':56B 'payload':156C 'plugin':5A,36B,44B,92C,198C 'possibl':134C 'run':72B 'sanit':52B,127C 'script':69B,71B,102C,142C 'send':165C 'site':101C 'state':195C 'store':7A,67B,98C,158C 'subject':11A,55B,105C,113C,173C 'submitt':65B,171C 'submitter-control':170C 'unauthent':6A,136C 'user':78B,150C 'version':117C 'via':9A,103C,106C,161C 'vulner':96C 'web':141C 'whenev':148C 'without':159C 'wordpress':4A,33B,43B,94C 'wp':35B,58B,107C 'wp-plugin':34B 'wpo365':1A,18A,24A,38B,87C 'wpo365-msgraphmailer':23A 'xss':8A 'your-subject':111C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the WPO365 Graph Mailer plugin at version 6.2 or lower, with Graph Mailer enabled. The payload is stored without login when OAuth authorization is incomplete, which the sources describe as the default state right after activation. Sites that do not use Graph Mailer or that have completed OAuth authorization are not described as exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T08:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107759","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107759","severity":null,"published_at":"2026-10-31T08:16:48+00:00","modified_at":"2026-10-31T08:16:48+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","fetched_at":"2026-10-31T08:34:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107759:1228","url":null,"severity":null,"published_at":"2026-10-31T08:36:08+00:00","modified_at":"2026-10-31T08:36:08+00:00","first_seen_at":"2026-10-31T08:36:08+00:00","fetched_at":"2026-10-31T08:36:08+00:00","note":"NVD/Wordfence: <=6.2 affected. Vendor changelog (wordpress.org) shows 6.3 on 2026-10-18 with an unspecified XSS fix; it does not name this CVE, so the fix is probable, not confirmed. Nothing marked verified. No exploitation or PoC found. Skipped X search. Mitigation (inferred, not vendor-stated): complete OAuth authorization or disable Graph Mailer."}],"documents":[{"id":30700,"url":"https://wordpress.org/plugins/wpo365-msgraphmailer/","title":"WPO365 Graph Mailer changelog (wordpress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":30701,"url":"https://www.wpo365.com/change-log/","title":"WPO365 change log","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}