← Vulnerability feed

Vulnerability record · CVE-2023-2488 · published 5 June 2023

CVE-2023-2488: Trumani stop spammers vulnerability

Trumani · Stop Spammers

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

6.1 CVSS 3.1 Medium EPSS 0.52% · top 58.0%
6.1CVSS 3.1 base score
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/60226669-0b7b-441f-93d4-b5933e69478f ExploitThird Party Advisory
https://wpscan.com/vulnerability/60226669-0b7b-441f-93d4-b5933e69478f ExploitThird Party Advisory

Track CVE-2023-2488 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-4120Trumani stop spammers vulnerabilityThe Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() P…EPSS 18%6.1CVE-2021-24245Trumani stop spammers cross-site scripting vulnerabilityThe Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an…EPSS 5.7%5.4CVE-2021-24517Trumani stop spammers cross-site scripting vulnerabilityThe Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high pr…EPSS 0.62%4.8CVE-2023-2489Trumani stop spammers vulnerabilityThe Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which …EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2023-2488), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.