Wpo365 Microsoft 365 Graph Mailer
Monthly
Stored cross-site scripting in the WPO365 | Microsoft 365 Graph Mailer WordPress plugin, affecting all versions up to and including 6.2, lets unauthenticated attackers plant arbitrary script in a mail subject that is stored and later rendered back to a viewer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) reflects unauthenticated network reach with a scope change and limited confidentiality and integrity impact. Exploitation is conditional: the Graph Mailer must be enabled while OAuth authorization has not been completed - the default state right after activation - and the site must expose a mail-sending feature that forwards a submitter-controlled subject, such as a public Contact Form 7 form; the injected script only runs when a user, likely an administrator reviewing the mail log or the affected page, actually opens it. No confirmed public exploit code and no CISA KEV listing were identified at time of analysis; the vuln.today decision label is this_week, so this is a moderate-but-real priority rather than an emergency.
Stored cross-site scripting in the WPO365 | Microsoft 365 Graph Mailer WordPress plugin, affecting all versions up to and including 6.2, lets unauthenticated attackers plant arbitrary script in a mail subject that is stored and later rendered back to a viewer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) reflects unauthenticated network reach with a scope change and limited confidentiality and integrity impact. Exploitation is conditional: the Graph Mailer must be enabled while OAuth authorization has not been completed - the default state right after activation - and the site must expose a mail-sending feature that forwards a submitter-controlled subject, such as a public Contact Form 7 form; the injected script only runs when a user, likely an administrator reviewing the mail log or the affected page, actually opens it. No confirmed public exploit code and no CISA KEV listing were identified at time of analysis; the vuln.today decision label is this_week, so this is a moderate-but-real priority rather than an emergency.