CVE-2021-24245
Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)
The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue.
Affected products
Trumani · Stop Spammerspublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/162623/WordPress-Stop-Spammers-2021.8-Cross-Site-Scripting.htmlunverifiedexploitdbwww.exploit-db.com/exploits/49880unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →