Stored Cross-Site Scripting Vulnerability in GoSMTP Pro Plugin for WordPress
CVE-2026-96768

7.2HIGH

Key Information:

Vendor

WordPress
Status
Gosmtp Pro
Vendor
CVE Published:
16 October 2026

What is CVE-2026-96768?

The GoSMTP Pro plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) via comment content in the email log body across all versions up to 1.2.3. This occurs due to inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject malicious web scripts. When users access affected pages, these scripts can execute, risking exposure to sensitive data. The issue arises because the plugin's handling of WordPress comment kses does not adequately filter out entity-encoded tag delimiters, permitting harmful content to be accepted as safe text. Subsequently, the payload is decoded into active HTML during email notifications, which are then stored directly in the plugin's email log database.

Affected Version(s)

GoSMTP Pro 0 <= 1.2.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://gosmtp.net/blog/gosmtp-1-2-4-launched/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad
.