The vulnerability lies in how GoSMTP Pro handles comment content that is later stored in an email log. Insufficient input sanitization and output escaping allow an unauthenticated attacker to embed encoded HTML tags within a comment. When the comment is retrieved, WordPress’s core email notification functions decode the entity‑encoded delimiters and write the data verbatim into the plugin’s email log database table, resulting in stored cross‑site scripting. This flaw enables attackers to execute arbitrary scripts in the context of any user who views the affected page, potentially granting session hijacking, data theft, or defacement capabilities.

All installations of the GoSMTP Pro WordPress plugin up to and including version 1.2.3 are affected. The vendor identified in the CNA is Softaculous. Because the flaw is tied to the plugin’s email logging, any WordPress sites that use these versions and have comments enabled are at risk.

The CVSS score of 7.2 indicates a high severity, though the EPSS score is not available, so the precise likelihood of exploitation is unknown. The flaw is not listed in the CISA KEV catalog, but its nature as a stored XSS that requires no authentication makes it a valuable target for attackers. An adversary could inject malicious scripts via any comment submission, bypass moderation because WordPress comment kses does not strip entity‑encoded tags, and those scripts would run for any user who views the page that displays the email log. The attack vector is straightforward: submit a crafted comment that is logged; an unauthenticated attacker can then harvest session cookies or perform other in‑browser attacks on later users.