CVE-2026-120477 Stop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter

The Stop Spammers Classic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' POST parameter in versions up to, and including, 2026.6. An unauthenticated POST handled on init stores the attacker-supplied author field after sanitizetextfield, which does not escape...