CVE-2026-120477: Stop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter

Q: Which users can inject the malicious value?

An attacker does not need to authenticate. The affected request is handled during WordPress initialization and stores the supplied author value in the plugin's registration-statistics history.

Q: What must happen for the stored script to execute?

An administrator with manage_options access must open the Log Report page and click the “Report to SFS” link on a poisoned log row. The attacker cannot independently trigger execution.

Q: Are installations using the default plugin configuration exposed to script execution?

The StopForumSpam API key is empty by default. Because the “Report to SFS” link is rendered only when that key is configured, the described execution path requires a configured API key.

Q: What can be done if updating is not immediately possible?

Avoid clicking “Report to SFS” links for log entries that may be attacker-controlled. Removing or leaving the StopForumSpam API key unset prevents that link from being rendered in the described attack path.

Q: How can an administrator check for prior poisoning attempts?

Review the ss_stop_sp_reg_stats option history used by the plugin for unexpected or suspicious author values. Attacker-supplied author data is stored there before it is rendered on the Log Report page.

Published Nov 7, 2026

Updated

The Stop Spammers Classic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' POST parameter in versions up to, and including, 2026.6. An unauthenticated POST handled on init stores the attacker-supplied author field (after sanitizetextfield, which does not escape single quotes) into the ssstopspregstats option history. The Log Report admin page then renders that stored value inside a single-quoted JavaScript string within a double-quoted onclick attribute using escjs(); because escjs() uses wpspecialchars with ENTCOMPAT it does not escape single quotes, allowing the stored value to break out of the JS string literal and inject arbitrary JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever an administrator with manageoptions access clicks the 'Report to SFS' link on an attacker-poisoned log row (the StopForumSpam API key must be configured for that link to be rendered — the field is empty by default). Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

Event History

Nov 7, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can inject the malicious value?

An attacker does not need to authenticate. The affected request is handled during WordPress initialization and stores the supplied author value in the plugin's registration-statistics history.

What must happen for the stored script to execute?

An administrator with manage_options access must open the Log Report page and click the “Report to SFS” link on a poisoned log row. The attacker cannot independently trigger execution.

Are installations using the default plugin configuration exposed to script execution?

The StopForumSpam API key is empty by default. Because the “Report to SFS” link is rendered only when that key is configured, the described execution path requires a configured API key.

What can be done if updating is not immediately possible?

Avoid clicking “Report to SFS” links for log entries that may be attacker-controlled. Removing or leaving the StopForumSpam API key unset prevents that link from being rendered in the described attack path.

How can an administrator check for prior poisoning attempts?

Review the ss_stop_sp_reg_stats option history used by the plugin for unexpected or suspicious author values. Attacker-supplied author data is stored there before it is rendered on the Log Report page.

CVE-2026-120477: Stop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter

Event History

Frequently Asked Questions

Which users can inject the malicious value?

What must happen for the stored script to execute?

Are installations using the default plugin configuration exposed to script execution?

What can be done if updating is not immediately possible?

How can an administrator check for prior poisoning attempts?

Company

Resources

Contact

Frequently Asked Questions

Which users can inject the malicious value?

What must happen for the stored script to execute?

Are installations using the default plugin configuration exposed to script execution?

What can be done if updating is not immediately possible?

How can an administrator check for prior poisoning attempts?