WPO365 Graph Mailer EUVD-2026-114654

Requires the WPO365 Graph Mailer to be enabled while OAuth authorization has NOT been completed - described as the default state immediately after plugin activation - and requires a mail-sending feature that forwards a submitter-controlled subject to the mailer (e.g., an active Contact Form 7 form reachable by the public). Exploitation is limited by these factors: a site that has completed OAuth configuration or that exposes no subject-forwarding form is not exposed via this path, and the payload only executes when a user (likely an administrator reviewing the mail log/injected page) actually accesses the affected page.

Multiple signals point to a moderate-but-real priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) is attacker-favorable on reachability - network-reachable, low complexity, no privileges, with a scope change reflecting script execution in a victim's browser context - but impact is capped at C:L/I:L/A:N, typical of stored XSS. The vuln.today decision label is 'this_week', not act_now/emergency, which is consistent with that profile. No EPSS probability was supplied, there is no CISA KEV listing (so this is NOT confirmed actively exploited), and no public exploit identified at time of analysis - the references are the Wordfence advisory and WordPress trac source-code/changeset links, not working exploit code. A notable nuance: although PR:N implies unauthenticated injection, exploitation is conditioned on the Graph Mailer being enabled while OAuth authorization has not been completed; the description states this is the default state immediately after activation, which supports the unauthenticated rating but also means fully-configured sites may not be exposed. Net: treat as a prompt patch-this-week item, not a drop-everything emergency; the absence of EPSS and the conditional trigger state are the main gaps to verify.

An attacker submits a public form (e.g., Contact Form 7) on a WordPress site running WPO365 Graph Mailer that is enabled but not yet OAuth-authorized, placing a JavaScript payload in the submitter-controlled subject field. The unsanitized subject is stored and later rendered unescaped (e.g., in the plugin's mail log), executing in the browser of a user - typically an administrator - who views the injected page. No public exploit code is referenced; only the vendor advisory and source-code links exist.