WordPress WPO365 Plugin Stored XSS via Email Subject

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in email subject line handling affecting all versions through 6.2. Attackers can inject malicious JavaScript payloads through the subject parameter without authentication, which persists in the database and executes whenever users access affected pages. This vulnerability is particularly dangerous because it requires no user interaction beyond visiting a page, affects all WordPress sites using this plugin regardless of user role, and can be exploited to steal session tokens, redirect users to phishing sites, or harvest sensitive data from administrators and site visitors.

Casky's platform maps this vulnerability to Initial Access (TA0001) and Exfiltration (TA0043) techniques, with 323 security skills that detect the attack patterns through extended reasoning. Practitioners using Casky would identify suspicious input flows where unsanitized user-controlled data reaches output contexts without proper escaping, particularly in mail-related functions. The platform's skills flag CWE-79 violations by detecting patterns where data from wp_mail parameters flows directly to page rendering without sanitization checks. Security teams would see findings highlighting the absence of proper output encoding on email subjects, detection of script tags or event handlers in stored parameters, and identification of authentication bypass allowing unauthenticated payload injection—enabling practitioners to prioritize remediation and audit existing plugin deployments for injected content.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-107759.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-107759

Casky has 323 skills that investigate the attack patterns behind CVE-2026-107759. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn