Threats tagged 'ghsa-xvc3-wff6-474c'

The Stop Spammers Classic WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the 'author' POST parameter in versions up to and including 2026.6. An unauthenticated attacker can inject JavaScript code that is stored and later executed when an administrator with manage_options capability clicks a specific 'Report to SFS' link in the admin interface. Exploitation requires the StopForumSpam API key to be configured and an administrator action to trigger the payload execution.