CVE-2026-96768: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in softaculous GoSMTP Pro

CVE-2026-96768 is a stored cross-site scripting vulnerability in the GoSMTP Pro WordPress plugin (versions up to 1.2.3). The flaw stems from improper neutralization of input during web page generation, specifically in comment content displayed in the email log body. WordPress's comment filtering (kses) does not remove entity-encoded tag delimiters, enabling attackers to inject scripts that are stored and later rendered as live HTML when email notifications are processed and logged by the plugin. This allows unauthenticated attackers to execute arbitrary scripts in the context of users viewing the email log pages.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of users accessing the plugin's email log pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the email log pages to trusted users only and consider disabling or removing the plugin if possible to prevent exploitation.