CVE-2021-24245

The CVE-2021-24245 entry pertains to the WordPress Stop Spammers plugin (pre-2021.9). A reflected XSS exists because the plugin does not properly escape user input when blocking requests, outputting the input in an attribute after filtering HTML tags. This leads to potential script injection in p...

CVE-2022-4120

The CVE-2022-4120 entry documents a vulnerability in the Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin. Prior to version 2022.6, the plugin passes base64-encoded user input to PHP’s unserialize() when CAPTCHA is used as the second challenge, which can lead to PHP Obj...

CVE-2023-2488

The CVE refers to the WordPress plugin Stop Spammers Security | Block Spam Users, Comments, Forms, with versions prior to 2023 vulnerable to a Reflected XSS due to insufficient sanitisation/escaping of parameters when rendering admin dashboard pages. The impact targets high-privilege users (e.g.,...

CVE-2023-2489

CVE-2023-2489 relates to the WordPress plugin Stop Spammers Security | Block Spam Users, Comments, Forms. The public docs indicate the issue stems from inadequate sanitization/escaping of certain plugin settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html...

CVE-2021-24517

The CVE-2021-24517 entry concerns the WordPress plugin Stop Spammers Security (before version 2021.18). The vulnerability arises because the plugin does not escape certain settings, enabling authenticated users with high privileges (e.g., admin) to inject Cross-Site Scripting payloads even when u...