Vulnerabilidad · Publicado 16/10/2026
El plugin GoSMTP Pro para WordPress versiones hasta 1.2.3 contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el cuerpo del registro de correos electrónicos. Un atacante no autenticado puede inyectar scripts maliciosos a través de comentarios que se ejecutarán en navegadores de usuarios administrativos y visitantes. Esta vulnerabilidad afecta principalmente a sitios de comercio electrónico, empresas de servicios y portales informativos en LATAM que utilizan este plugin para gestionar notificaciones por correo.
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table.
Score: 7.2/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE-79
Publicado en NIST NVD.