WPO365 | MICROSOFT 365 GRAPH MAILER: Stored Cross-Site Scripting (CVE-2026-107759)

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions 6.2 and earlier. The vulnerability exists due to improper input sanitization and output escaping within the subject parameter when processing mail via wp_mail/PHPMailer (e.g., when used with Contact Form 7). An unauthenticated attacker can exploit this when the plugin is enabled but has not yet completed its OAuth authorization process, which is the default state immediately after installation. Successful exploitation allows for the execution of arbitrary scripts in the context of a user accessing the affected page.

Impact

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts in the browser of a victim who views the affected page. This could lead to session hijacking, unauthorized actions on behalf of the victim, or content manipulation within the WordPress environment.

Recommendation

• Identify all WordPress instances running the WPO365 | MICROSOFT 365 GRAPH MAILER plugin and upgrade to the version that includes the fix for CVE-2026-107759.
• Until an update can be applied, ensure that all installations of the plugin are properly configured with OAuth authorization to close the identified exploitation window.
• Review plugin logs for abnormal submissions via integrated contact forms that might indicate active probing of the vulnerable parameter.