GoSMTP Pro CVE-2026-96768

Exploitation requires that the target WordPress site accepts comments from unauthenticated visitors (the default WordPress comment form) and that the GoSMTP Pro plugin (≤1.2.3) is active and configured to log/email comment notifications, so the comment body flows through the plugin's email-log writing path. The payload must be entity-encoded to survive WordPress comment kses moderation. The primary limiting factor is that the injected script only executes when a privileged user (typically an administrator) opens the plugin's email log page, so a victim must view the log for impact to occur; sites that disable comments or do not use this plugin's email logging are not exposed.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes network-reachable, low-complexity, unauthenticated exploitation with a scope change and limited confidentiality/integrity impact - consistent with a stored XSS whose payload is injected via unauthenticated comment submission and later rendered in the plugin's email log (the scope change reflects the comment author's input crossing a trust boundary into the privileged log-viewing context, typically an administrator's browser). No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The elevated base score is driven by the unauthenticated vector plus scope change, not by high-impact code execution - impact is limited to script execution in a victim's session (C:L/I:L, A:N). Signals are internally consistent: there is no CVSS-versus-description conflict and no KEV/EPSS contradiction to flag. Net: a real, patch-worthy HIGH-severity stored XSS reachable without authentication, but with no evidence of active or automated exploitation and bounded technical impact.

An unauthenticated attacker submits a blog comment containing an entity-encoded XSS payload that passes WordPress comment kses moderation as benign text. When the plugin's email notification function processes the comment it decodes the entities into live HTML and writes it verbatim into the email log table; the script then executes in the browser of any administrator who views that email log. No public proof-of-concept is referenced in the provided data.