Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · stop-spammer-registrations-plugin
Stop Spammers Classic
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.CVE-2026-48876 · affects up to 2026.3 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.
Jan 28, 2026Stop Spammers Classic: Cross-Site Request ForgeryCVE-2025-14795 · affects up to 2026.1 · reported by WordfenceMedium 4.3
The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing nonce validation in the ss_addtoallowlist class. This makes it possible for unauthenticated attackers to add arbitrary email addresses to the spam allowlist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The vulnerability was partially patched in version 2026.1.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms: Cross-Site Request ForgeryCVE-2025-2935 · affects up to 2024.7 · reported by WordfenceMedium 5.4
The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ss_option_maint.php' and 'ss_user_filter_list' files. This makes it possible for unauthenticated attackers to delete pending comments, and re-enable a previously blocked user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 4, 2024Stop Spammers Security | Block Spam Users, Comments, Forms: Cross-Site Request ForgeryCVE-2023-7065 · affects up to 2024.4 · reported by WordfenceMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfs_process AJAX action. This makes it possible for unauthenticated attackers to add arbitrary IPs to the plugin's allowlist and blocklist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · fixed in 2023 · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · fixed in 2023 · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Dec 26, 2022Stop Spammers Security | Block Spam Users, Comments, Forms: Passes base64 encoded user input to the unserialize() PHP functionCVE-2022-4120 · fixed in 2022.6 · reported by WPScanCritical 9.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · fixed in 2021.18 · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.