Stored Cross-Site Scripting in WPO365 | MICROSOFT 365 GRAPH MAILER Plugin for WordPress

CVE-2026-107759

What is CVE-2026-107759?

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress allows unauthenticated attackers to exploit a stored Cross-Site Scripting vulnerability through the 'Subject' parameter. The absence of adequate input sanitization and output escaping means attackers can inject arbitrary web scripts. This occurs when a mail-sending feature forwards a submitter-controlled subject, especially if OAuth authorization is not completed, a common situation right after plugin activation. This vulnerability could let an attacker run malicious scripts in the browser of a user who accesses the affected pages.

References