Live › vulnerability › CVE-2026-96768
Go to dashboardThe GoSMTP Pro WordPress plugin up to and including 1.2.3 fails to sanitize comment content written into its email log table. An unauthenticated attacker can post a comment carrying entity-encoded script that is decoded into live HTML and runs when an administrator opens the email log.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites running GoSMTP Pro at version 1.2.3 or earlier are exposed, since the payload is written by comment submission and rendered in the plugin's email log. Sites that do not run the plugin can skip it. Sites that run it should treat the email log view as an admin-facing XSS surface.
No product ranges from the sources yet.
wp plugin get gosmtp --field=version (unknown whether this exact slug is correct)1.2.3 once a fixed release is published (fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.
This page as .md · .json · in your agent: get_signal("CVE-2026-96768")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.