Gosmtp Pro
Monthly
Stored cross-site scripting in the GoSMTP Pro WordPress plugin (all versions up to and including 1.2.3) lets unauthenticated attackers plant arbitrary JavaScript inside the plugin's email-log records by submitting a comment crafted so that it survives WordPress comment kses moderation while entity-encoded, then is decoded into live HTML by core email notification handling and written verbatim to the plugin's log table. The script fires only when a privileged user, typically an administrator, opens the email-log page in wp-admin, which keeps real-world impact moderate despite the network-reachable, unauthenticated injection path; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. Exposure is limited to sites that accept comments from unauthenticated visitors and have GoSMTP Pro active with comment notification email logging enabled, while sites with comments disabled or logging unused are not affected.
Stored cross-site scripting in the GoSMTP Pro WordPress plugin (all versions up to and including 1.2.3) lets unauthenticated attackers plant arbitrary JavaScript inside the plugin's email-log records by submitting a comment crafted so that it survives WordPress comment kses moderation while entity-encoded, then is decoded into live HTML by core email notification handling and written verbatim to the plugin's log table. The script fires only when a privileged user, typically an administrator, opens the email-log page in wp-admin, which keeps real-world impact moderate despite the network-reachable, unauthenticated injection path; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. Exposure is limited to sites that accept comments from unauthenticated visitors and have GoSMTP Pro active with comment notification email logging enabled, while sites with comments disabled or logging unused are not affected.