Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · zero-spam
zero-spam
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 6, 2026Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.CVE-2026-105057 · affects up to 5.7.11 · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.
Sep 25, 2026Zero Spam for: Stored Cross-Site ScriptingCVE-2026-96752 · affects up to 5.7.10 · reported by WordfenceHigh 7.2
The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered by submitting a Contact Form 7 request with a nested POST array key containing arbitrary HTML or JavaScript — PHP parses the field name into a nested array key, which is stored verbatim in the zerospam_log.submission_data column when Zero Spam flags the submission as spam due to the absence of the zerospam_david_walsh_key field.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 17, 2024Zero Spam: Client-Side Enforcement of Server-Side SecurityCVE-2024-32521 · affects up to 5.5.6 · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zero Spam: from n/a through 5.5.6.
Nov 3, 2023Zero Spam for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-32121 · affects up to 5.4.4 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injection.This issue affects Zero Spam for WordPress: from n/a through 5.4.4.
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · fixed in 5.2.11 · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.