{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wpo365--microsoft-365-graph-mailer--6.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpo365:microsoft_365_graph_mailer:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-107759"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WPO365 | MICROSOFT 365 GRAPH MAILER (\u003c= 6.2)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","wordpress","cve-2026-107759"],"_cs_type":"advisory","_cs_vendors":["WPO365"],"content_html":"\u003cp\u003eThe WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions 6.2 and earlier. The vulnerability exists due to improper input sanitization and output escaping within the subject parameter when processing mail via wp_mail/PHPMailer (e.g., when used with Contact Form 7). An unauthenticated attacker can exploit this when the plugin is enabled but has not yet completed its OAuth authorization process, which is the default state immediately after installation. Successful exploitation allows for the execution of arbitrary scripts in the context of a user accessing the affected page.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts in the browser of a victim who views the affected page. This could lead to session hijacking, unauthorized actions on behalf of the victim, or content manipulation within the WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all WordPress instances running the WPO365 | MICROSOFT 365 GRAPH MAILER plugin and upgrade to the version that includes the fix for CVE-2026-107759.\u003c/li\u003e\n\u003cli\u003eUntil an update can be applied, ensure that all installations of the plugin are properly configured with OAuth authorization to close the identified exploitation window.\u003c/li\u003e\n\u003cli\u003eReview plugin logs for abnormal submissions via integrated contact forms that might indicate active probing of the vulnerable parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T09:55:20Z","date_published":"2026-10-31T09:55:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wpo365-xss/","summary":"The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a Stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject arbitrary web scripts via the mail subject parameter.","title":"WPO365 | MICROSOFT 365 GRAPH MAILER: Stored Cross-Site Scripting (CVE-2026-107759)","url":"https://feed.craftedsignal.io/briefs/2026-10-wpo365-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - WPO365 | MICROSOFT 365 GRAPH MAILER (\u003c= 6.2)","version":"https://jsonfeed.org/version/1.1"}