---
id: "CVE-2026-107759"
kind: "vulnerability"
aliases: ["CVE-2026-107759"]
title: "WPO365 Graph Mailer WordPress plugin: unauthenticated stored XSS via mail subject"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "WPO365 | MICROSOFT 365 GRAPH MAILER (wpo365-msgraphmailer)", "fixed": ["6.3"], "affected": "<= 6.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["contact-form-7", "microsoft-365", "package", "wordpress", "wp-plugin"]
not_affected_if: ["graph-mailer-disabled", "oauth-completed", "plugin-not-installed"]
published_at: "2026-10-31T08:16:48+00:00"
first_seen_at: "2026-10-31T08:34:28+00:00"
updated_at: "2026-10-31T08:36:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107759", "first_seen_at": "2026-10-31T08:34:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T08:36:08+00:00"}]
---

# WPO365 Graph Mailer WordPress plugin: unauthenticated stored XSS via mail subject

The WPO365 Microsoft 365 Graph Mailer WordPress plugin, up to and including 6.2, does not sanitize the mail subject passed through wp_mail, so a Contact Form 7 submitter can store a script. The script runs in the browser of any user who opens the affected page, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:WPO365 | MICROSOFT 365 GRAPH MAILER (wpo365-msgraphmailer) affected <= 6.2 fixed 6.3

## How to check

- Check whether the WPO365 Graph Mailer plugin is installed and its version is `6.2` or lower.
- Check whether Graph Mailer is enabled while OAuth authorization has not been completed.
- Check whether a contact or mail form forwards a visitor-supplied subject, such as a Contact Form 7 `your-subject` field.

## Fix

Update WPO365 Graph Mailer to 6.3 (released 2026-10-18), the current wordpress.org version. Its changelog lists 'Security: Fixed a cross-site scripting (XSS) vulnerability' and hardened mail authorization, but does not name this CVE or the mail subject. Version 6.2 also claimed an XSS fix and is still listed as affected.

## Timeline

- 2026-10-31T08:34:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107759
- 2026-10-31T08:36:08+00:00 analyst — NVD/Wordfence: <=6.2 affected. Vendor changelog (wordpress.org) shows 6.3 on 2026-10-18 with an unspecified XSS fix; it does not name this CVE, so the fix is probable, not confirmed. Nothing marked verified. No exploitation or PoC found. Skipped X search. Mitigation (inferred, not vendor-stated): complete OAuth authorization or disable Graph Mailer.

## Documents

- [describes] WPO365 change log https://www.wpo365.com/change-log/
- [fix] WPO365 Graph Mailer changelog (wordpress.org) https://wordpress.org/plugins/wpo365-msgraphmailer/

## From the sources

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_