CVE-2026-120477

The Stop Spammers Classic plugin for WordPress (versions up to and including 2026.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that an unauthenticated POST request can store an attacker-supplied value in the author parameter into the ss_stop_sp_reg_stats option histo...