{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agosmtpgosmtp_prowordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gosmtp:gosmtp_pro:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-96768"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GoSMTP Pro (\u003c= 1.2.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["GoSMTP"],"content_html":"\u003cp\u003eThe GoSMTP Pro plugin for WordPress is affected by a stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-96768, which affects all versions up to and including 1.2.3. The flaw exists due to insufficient input sanitization and output escaping when processing email log body content. An unauthenticated attacker can exploit this by crafting a malicious payload that bypasses WordPress's standard moderation filters, as the plugin incorrectly handles entity-encoded tag delimiters.\u003c/p\u003e\n\u003cp\u003eWhen the payload is processed, it is written verbatim into the plugin's email log database table. The malicious script executes in the browser of any user - typically an administrator - who views the email log via the WordPress dashboard. Because the payload passes initial moderation checks as safe text before being decoded, this vulnerability presents a significant risk for session hijacking or unauthorized administrative actions. Defenders should prioritize patching or disabling the plugin until an update is applied.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability enables unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated user's session. If successful, this can lead to full account takeover of administrative accounts, unauthorized configuration changes, or the injection of additional malicious content within the WordPress environment. This vulnerability affects all installations of GoSMTP Pro version 1.2.3 and below.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately disable the GoSMTP Pro plugin until a patch is available or upgrade to a version remediating CVE-2026-96768.\u003c/li\u003e\n\u003cli\u003eAudit WordPress administrative dashboard access logs for suspicious activity targeting email log views.\u003c/li\u003e\n\u003cli\u003eImplement or strengthen Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in the WordPress dashboard.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T10:26:16Z","date_published":"2026-10-16T10:26:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gosmtp-xss/","summary":"An unauthenticated stored XSS vulnerability in GoSMTP Pro (\u003c= 1.2.3) allows attackers to inject arbitrary web scripts via email log body content.","title":"Stored XSS Vulnerability in GoSMTP Pro for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-10-gosmtp-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:gosmtp:gosmtp_pro:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}