{"id":"CVE-2026-96768","kind":"vulnerability","aliases":["CVE-2026-96768"],"related":[],"title":"GoSMTP Pro WordPress plugin: unauthenticated stored XSS via comment email log","description":"The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.","summary":"The GoSMTP Pro WordPress plugin up to and including 1.2.3 fails to sanitize comment content written into its email log table. An unauthenticated attacker can post a comment carrying entity-encoded script that is decoded into live HTML and runs when an administrator opens the email log.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-version-above-1.2.3"],"how_to_check":"- Check the installed GoSMTP Pro plugin version in the WordPress admin plugin list or with `wp plugin get gosmtp --field=version` (unknown whether this exact slug is correct)\n- Look for the GoSMTP Pro email log page under the WordPress admin menu on sites that run it","fix":"- Update GoSMTP Pro to a version newer than `1.2.3` once a fixed release is published (fixed version unknown from the sources)\n- Until patched, disable or remove the GoSMTP Pro plugin","status":"open","published_at":"2026-10-16T10:18:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:29:36+00:00","updated_at":"2026-10-25T03:29:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:29:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update GoSMTP Pro to a version newer than `1.2.3` once a fixed release is published (fixed version unknown from the sources)\n- Until patched, disable or remove the GoSMTP Pro plugin","reach":"internet","title":"GoSMTP Pro WordPress plugin: unauthenticated stored XSS via comment email log","impact":"medium","summary":"The GoSMTP Pro WordPress plugin up to and including 1.2.3 fails to sanitize comment content written into its email log table. An unauthenticated attacker can post a comment carrying entity-encoded script that is decoded into live HTML and runs when an administrator opens the email log.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"script runs in an admin's browser, enabling account takeover","analyst_note":"Confirm the fixed plugin version and whether the email log view is reachable by admins, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-96768.","how_to_check":"- Check the installed GoSMTP Pro plugin version in the WordPress admin plugin list or with `wp plugin get gosmtp --field=version` (unknown whether this exact slug is correct)\n- Look for the GoSMTP Pro email log page under the WordPress admin menu on sites that run it","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-1.2.3"],"who_is_affected":"WordPress sites running GoSMTP Pro at version 1.2.3 or earlier are exposed, since the payload is written by comment submission and rendered in the plugin's email log. Sites that do not run the plugin can skip it. Sites that run it should treat the email log view as an admin-facing XSS surface.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":3446,"output_tokens":682,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96768':14A,17A '1.2.3':35B,102C 'access':131C 'administr':69B 'allow':152C 'arbitrari':120C 'attack':49B,117C 'bodi':94C 'carri':54B 'comment':9A,39B,53B,89C,142C 'content':40B,90C 'core':168C 'cross':85C 'cross-sit':84C 'cve':12A,15A 'databas':181C 'decod':61B,163C 'delimit':151C 'due':103C 'email':10A,44B,72B,92C,169C,179C 'encod':57B,149C 'entiti':56B,148C 'entity-encod':55B,147C 'escap':110C 'execut':127C 'exploit':136C 'fail':36B 'function':171C 'gosmtp':1A,27B,75C 'host':21B 'html':64B,166C 'includ':34B,101C 'inject':119C,133C 'input':106C 'insuffici':105C 'kses':143C 'live':63B,165C 'log':11A,45B,73B,93C,180C 'made':138C 'make':112C 'moder':157C 'notif':170C 'open':70B 'output':109C 'packag':18B 'page':124C,134C 'pass':156C 'payload':154C 'plugin':4A,25B,30B,77C,177C 'possibl':114C,139C 'post':51B 'pro':2A,28B,76C 'run':66B 'safe':159C 'sanit':38B,107C 'script':58B,87C,122C 'self':20B 'self-host':19B 'site':86C 'store':6A,83C 'strip':146C 'tabl':46B,182C 'tag':150C 'text':160C 'unauthent':5A,48B,116C 'user':130C 'verbatim':174C 'version':97C 'via':8A,88C,91C 'vulner':81C 'web':121C 'whenev':128C 'wordpress':3A,22B,24B,29B,79C,141C 'wordpress-plugin':23B 'written':41B,173C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running GoSMTP Pro at version 1.2.3 or earlier are exposed, since the payload is written by comment submission and rendered in the plugin's email log. Sites that do not run the plugin can skip it. Sites that run it should treat the email log view as an admin-facing XSS surface.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T10:18:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96768","severity":null,"published_at":"2026-10-16T10:18:05+00:00","modified_at":"2026-10-16T15:17:37+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}