---
id: "CVE-2026-96768"
kind: "vulnerability"
aliases: ["CVE-2026-96768"]
title: "GoSMTP Pro WordPress plugin: unauthenticated stored XSS via comment email log"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "plugin-version-above-1.2.3"]
published_at: "2026-10-16T10:18:05+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:29:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96768", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# GoSMTP Pro WordPress plugin: unauthenticated stored XSS via comment email log

The GoSMTP Pro WordPress plugin up to and including 1.2.3 fails to sanitize comment content written into its email log table. An unauthenticated attacker can post a comment carrying entity-encoded script that is decoded into live HTML and runs when an administrator opens the email log.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GoSMTP Pro plugin version in the WordPress admin plugin list or with `wp plugin get gosmtp --field=version` (unknown whether this exact slug is correct)
- Look for the GoSMTP Pro email log page under the WordPress admin menu on sites that run it

## Fix

- Update GoSMTP Pro to a version newer than `1.2.3` once a fixed release is published (fixed version unknown from the sources)
- Until patched, disable or remove the GoSMTP Pro plugin

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96768

## From the sources

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_