GoSMTP Pro (<= 1.2.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gosmtp-pro--1.2.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 10:26:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS Vulnerability in GoSMTP Pro for WordPresshttps://feed.craftedsignal.io/briefs/2026-10-gosmtp-xss/Fri, 16 Oct 2026 10:26:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-gosmtp-xss/An unauthenticated stored XSS vulnerability in GoSMTP Pro (<= 1.2.3) allows attackers to inject arbitrary web scripts via email log body content.The GoSMTP Pro plugin for WordPress is affected by a stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-96768, which affects all versions up to and including 1.2.3. The flaw exists due to insufficient input sanitization and output escaping when processing email log body content. An unauthenticated attacker can exploit this by crafting a malicious payload that bypasses WordPress's standard moderation filters, as the plugin incorrectly handles entity-encoded tag delimiters.

When the payload is processed, it is written verbatim into the plugin's email log database table. The malicious script executes in the browser of any user - typically an administrator - who views the email log via the WordPress dashboard. Because the payload passes initial moderation checks as safe text before being decoded, this vulnerability presents a significant risk for session hijacking or unauthorized administrative actions. Defenders should prioritize patching or disabling the plugin until an update is applied.

Impact

The vulnerability enables unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated user's session. If successful, this can lead to full account takeover of administrative accounts, unauthorized configuration changes, or the injection of additional malicious content within the WordPress environment. This vulnerability affects all installations of GoSMTP Pro version 1.2.3 and below.

Recommendation

  • Immediately disable the GoSMTP Pro plugin until a patch is available or upgrade to a version remediating CVE-2026-96768.
  • Audit WordPress administrative dashboard access logs for suspicious activity targeting email log views.
  • Implement or strengthen Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in the WordPress dashboard.
]]>highadvisory