Executive brief
Stop Spammers is a WordPress plugin designed to prevent spam registrations and comments. A security flaw in versions 2026.3 and earlier allows an attacker to inject malicious scripts into the website. If a site administrator or visitor interacts with a specially crafted link, the attacker could potentially hijack sessions, redirect users to malicious sites, or deface the website.
Technical details
The Stop Spammers plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input during web page generation (CWE-79). This vulnerability exists in versions up to and including 2026.3. An unauthenticated remote attacker can exploit this by tricking a user (typically an administrator) into clicking a malicious link or visiting a crafted page. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized actions. The issue is resolved in version 2026.4.
Affected products
- Stop Spammers Stop Spammers <= 2026.3
Timeline
- 2026-05-05: disclosed: Reported by Peleg Nagli (ultrared.ai)
- 2026-06-01: advisory: Patchstack published advisory and mitigation rules
- 2026-06-15: other: CVE record published/updated in NVD