Refine your search

2 vulnerabilities found for WPO365 | MICROSOFT 365 GRAPH MAILER by wpo365

CVE-2026-107759 (GCVE-0-2026-107759)
Vulnerability from cvelistv5
Published
2026-10-31 07:46
Modified
2026-11-01 17:44
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation
Summary
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation.
References
Impacted products
Vendor Product Version
wpo365 WPO365 | MICROSOFT 365 GRAPH MAILER Version: 0   ≤ 6.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-01T17:34:15.381772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-01T17:44:27.569Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPO365 | MICROSOFT 365 GRAPH MAILER",
          "vendor": "wpo365",
          "versions": [
            {
              "lessThanOrEqual": "6.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nick Verhelle (Bulldawg)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)\u0027 parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored without authentication via any mail-sending feature that forwards a submitter-controlled subject (e.g. a Contact Form 7 form) when the Graph Mailer is enabled but OAuth authorization has not been completed, a default state immediately after plugin activation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T07:46:52.028Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d51ba0c2-588d-4241-977a-9649cb77c78e?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/apps/dist/wizard-chunk-G9IB6WhS.js#L154"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Mail/Mailer.php#L71"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Services/Log_Service.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Core/Script_Helpers.php#L142"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wpo365-msgraphmailer/tags/6.1/Services/Ajax_Service.php#L284"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3752919%40wpo365-msgraphmailer\u0026new=3752919%40wpo365-msgraphmailer"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T19:59:03.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T19:15:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WPO365 | MICROSOFT 365 GRAPH MAILER \u003c= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107759",
    "datePublished": "2026-10-31T07:46:52.028Z",
    "dateReserved": "2026-10-08T19:00:47.678Z",
    "dateUpdated": "2026-11-01T17:44:27.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-1488 (GCVE-0-2025-1488)
Vulnerability from cvelistv5
Published
2025-02-24 11:10
Modified
2026-04-08 16:46
Severity ?
4.7 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Summary
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if 1. they can successfully trick them into performing an action and 2. the plugin is activated but not configured.
References
Impacted products
Vendor Product Version
wpo365 WPO365 | MICROSOFT 365 GRAPH MAILER Version: 0   ≤ 3.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1488",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-24T12:46:47.799172Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-24T12:47:14.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WPO365 | MICROSOFT 365 GRAPH MAILER",
          "vendor": "wpo365",
          "versions": [
            {
              "lessThanOrEqual": "3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Krzysztof Zaj\u0105c"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the \u0027redirect_to\u0027 parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if 1. they can successfully trick them into performing an action and 2. the plugin is activated but not configured."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:46:57.099Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a1782c3-ae0b-42f1-aa5e-dabfa2a5bbcd?source=cve"
        },
        {
          "url": "https://wordpress.org/plugins/wpo365-msgraphmailer/#developers"
        },
        {
          "url": "https://www.wpo365.com/change-log/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3244747/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-02-23T22:53:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WPO365 | MICROSOFT 365 GRAPH MAILER \u003c= 3.2 - Open Redirect via \u0027redirect_to\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-1488",
    "datePublished": "2025-02-24T11:10:08.896Z",
    "dateReserved": "2025-02-19T21:57:31.462Z",
    "dateUpdated": "2026-04-08T16:46:57.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}