CVE-2026-96768
Deferred Deferred - Pending Action

Stored XSS in GoSMTP Pro WordPress Plugin via Email Log

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-96768
EUVD
EUVD-2026-102830

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
softaculous GoSMTP Pro 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The GoSMTP Pro plugin for WordPress has a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping in comment content via email log body. Unauthenticated attackers can inject malicious scripts that execute when users access infected pages. The issue occurs because WordPress comment kses fails to strip entity-encoded tag delimiters, allowing payloads to bypass moderation as safe text before being decoded into live HTML by email notification functions and stored in the plugin's email log database.

Detection Guidance

This vulnerability involves stored XSS via comment content in GoSMTP Pro plugin logs. To detect it, inspect WordPress email logs for suspicious HTML/script content in comment fields. Check the plugin's database table where email logs are stored for unescaped scripts. Review WordPress comment moderation logs for unusual payloads.

Impact Analysis
  • Unauthenticated attackers could inject malicious scripts into pages that execute when viewed by users.
  • Compromised user accounts or sessions may occur if scripts steal cookies or credentials.
  • Website reputation damage due to unauthorized script execution on trusted pages.
  • Potential data theft or unauthorized actions performed on behalf of users.
Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. If exploited, it may result in data breaches that require regulatory reporting and potential fines under these standards.

Mitigation Strategies

Update GoSMTP Pro plugin to version 1.2.4 or later to address the vulnerability. Remove any suspicious scripts from email logs and review WordPress comment moderation settings to prevent future exploits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96768. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart