The vulnerability allows an attacker to embed malicious JavaScript into the email subject field which is sent through wp_mail/PHPMailer. When the Graph Mailer forwards this user‑controlled subject to a recipient, the script persists in the message and is executed whenever a user views the affected page. This stored XSS can be used for session hijacking, cookie theft, defacement, or delivery of additional payloads. The flaw arises from insufficient input sanitization and output escaping, enabling attackers to inject scripts without any authentication.

Any WordPress site running the WPO365 | MICROSOFT 365 GRAPH MAILER plugin up to and including version 6.2 is affected.

The CVSS score of 7.2 indicates a high impact severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the lack of authentication requirement and the stored nature of the payload make exploitation straightforward. An unauthenticated attacker can craft an email with a malicious Subject header via any mail‑sending feature that forwards user input. If the Graph Mailer is enabled immediately after plugin activation, OAuth has not yet been completed, providing a vulnerable default state. Consequently, the risk of exploitation is moderate to high for sites that enable the plugin without remedial actions.