Stop Spammers Classic

Stop Spammers Classic has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 9 are fixed as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (56%). Other recurring categories include Cross-Site Request Forgery (CSRF), Deserialization Of Untrusted Data.

Every one of the 9 issues recorded for Stop Spammers Classic has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, most of them (2) reported by Erwan LR. Stop Spammers Classic is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

5.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Stop Spammers Classic vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2022-4120

Stop Spammers Security <= 2022.5 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

9 records


2026-06-01 00:00	Stop Spammers Classic <= 2026.3 - Unauthenticated Stored Cross-Site Scripting Stop Spammers Classic <= 2026.3	`CVE-2026-48876`	7.2 High	Peleg Nagli (ultrared.ai)	Yes
2026-01-27 00:00	Stop Spammers Classic <= 2026.1 - Cross-Site Request Forgery via Email Allowlist Stop Spammers Classic <= 2026.1	`CVE-2025-14795`	4.3 Medium	JoanClarke2	Yes
2025-06-05 17:43	Anti-Spam: Spam Protection \| Block Spam Users, Comments, Forms <= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions Stop Spammers Classic <= 2024.7	`CVE-2025-2935`	5.4 Medium	Noah Stead (TurtleBurg)	Yes
2024-05-03 00:00	Stop Spammers Security \| Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process Stop Spammers Classic <= 2024.4	`CVE-2023-7065`	5.4 Medium	Lucio Sá	Yes
2023-05-15 00:00	Stop Spammers Security <= 2022.6 - Reflected Cross-Site Scripting Stop Spammers Classic <= 2022.6	`CVE-2023-2488`	6.1 Medium	Erwan LR	Yes
2023-05-15 00:00	Stop Spammers Security <= 2022.6 - Authenticated (Admin+) Stored Cross-Site Scripting Stop Spammers Classic <= 2022.6	`CVE-2023-2489`	4.4 Medium	Erwan LR	Yes
2022-12-05 00:00	Stop Spammers Security <= 2022.5 - Unauthenticated PHP Object Injection Stop Spammers Classic <= 2022.5	`CVE-2022-4120`	9.8 Critical	Seryeon Ham	Yes
2021-08-09 00:00	Stop Spammers Security <= 2021.17 - Authenticated (Admin+) Stored Cross-Site Scripting Stop Spammers Classic < 2021.18	`CVE-2021-24517`	4.8 Medium	swapnil subhash bodekar	Yes
2021-04-08 00:00	Stop Spammers <= 2021.8 - Reflected Cross-Site Scripting Stop Spammers Classic < 2021.9	`CVE-2021-24245`	6.1 Medium	Hosein_vita	Yes

Showing 1–9 of 9 reports

Latestv2026.6

Stop Spammers Classic

Author

Web Guy

4.4(243)

88/100

Last Updated

2026-07-18 (2mo ago)

Active Installs

30,000+

Downloads

2,655,523

Requires WP

5.0+

Requires PHP

5.0+

Tested up to

WP 7.0.4

Created

2010-08-10 (16y ago)

💬 Ask Question | 📧 Email Me Stop Spammers is now Dam Spam. Switching is easy. All of your settings migrate over automatically in the background. Stop Spammers Classic is legacy code that will receive security patches only moving forward. 🥪 Buy me a sandwich to help preserve Stop Spammers Classic or further project development in Dam Spam if you rely on either of them.

View on WordPress.org