The vulnerability lies in how GoSMTP Pro handles comment content that is later stored in an email log. Insufficient input sanitization and output escaping allow an unauthenticated attacker to embed encoded HTML tags within a comment. When the comment is retrieved, WordPress’s core email notification functions decode the entity‑encoded delimiters and write the data verbatim into the plugin’s email log database table, resulting in stored cross‑site scripting. This flaw enables arbitrary scripts to be executed in the browsers of any user who views an affected page.

All installations of the GoSMTP Pro WordPress plugin up to and including version 1.2.3 are affected. The vendor identified in the CNA is Softaculous. Because the flaw is tied to the plugin’s email logging, any WordPress sites that use these versions and have comments enabled are at risk.

The CVSS score of 7.2 indicates high severity, while the EPSS score of less than 1% indicates a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, but its nature as a stored XSS that requires no authentication makes it appealing. An adversary could inject malicious scripts via any comment submission, bypass moderation because WordPress comment kses does not strip entity‑encoded tags, and those scripts would run for any user who views the page that displays the email log. The attack vector is straightforward: submit a crafted comment that is logged; an unauthenticated attacker can then cause scripts to execute in the user's browser.