Threats tagged 'ghsa-jg4v-r26p-p7r2'

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'Subject' parameter used in mail-sending features. This vulnerability affects all versions up to and including 6.2 and allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. The issue arises due to insufficient input sanitization and output escaping, particularly when OAuth authorization is not completed immediately after plugin activation.