Gophish up to 0.12.1 contains stored and reflected cross‑site scripting vulnerabilities that let an attacker insert arbitrary script code by exploiting unescaped SMTP server error messages. The injected script runs in the browser context when an administrator views campaign results or sends test emails, enabling theft of sensitive data such as API keys.

The vulnerability affects Gophish installations through version 0.12.1. Administrators using any SMTP server for sending profiles are at risk unless they are running a later, patched release.

The CVSS score of 2.3 indicates low overall severity, and no EPSS data is available. The attack requires access or control over the SMTP server that Gophish communicates with, or the ability to intercept the SMTP traffic. Once the malicious SMTP error message is delivered, the victim must load a page that reflects the error, after which the injected script executes in the admin user's browser. As the vulnerability exists in a stored form, any administrator who views the affected data can be compromised. The risk is limited to the attacker’s control over the SMTP channel and the presence of an interactive admin session, so it is not a blind remote exploit.