← Vulnerability feed

Vulnerability record · CVE-2023-2489 · published 5 June 2023

CVE-2023-2489: Trumani stop spammers vulnerability

Trumani · Stop Spammers

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

4.8 CVSS 3.1 Medium EPSS 0.44% · top 64.0%
4.8CVSS 3.1 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/dcbe3334-357a-4744-b50c-309d10cca30d ExploitThird Party Advisory
https://wpscan.com/vulnerability/dcbe3334-357a-4744-b50c-309d10cca30d ExploitThird Party Advisory

Track CVE-2023-2489 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-4120Trumani stop spammers vulnerabilityThe Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() P…EPSS 18%6.1CVE-2023-2488Trumani stop spammers vulnerabilityThe Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before ou…EPSS 0.52%6.1CVE-2021-24245Trumani stop spammers cross-site scripting vulnerabilityThe Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an…EPSS 5.7%5.4CVE-2021-24517Trumani stop spammers cross-site scripting vulnerabilityThe Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high pr…EPSS 0.62%

Source: NIST National Vulnerability Database (record CVE-2023-2489), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.