Throws SPAM Away

Throws SPAM Away has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 8.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include SQL Injection.

Every one of the 2 issues recorded for Throws SPAM Away has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Throws SPAM Away is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSHigh

8.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Throws SPAM Away vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2022-1709

Throws SPAM Away <= 3.3 - Cross-Site Request Forgery to Comment Modification

Read the full analysis

Vulnerability Records

2 records


2026-08-28 00:00	Throws SPAM Away <= 3.8.2 - Unauthenticated SQL Injection Throws SPAM Away <= 3.8.2	`CVE-2026-81763`	7.5 High	Jiemook	Yes
2022-05-16 00:00	Throws SPAM Away <= 3.3 - Cross-Site Request Forgery to Comment Modification Throws SPAM Away < 3.3.1	`CVE-2022-1709`	8.8 High	Daniel Ruf	Yes

Showing 1–2 of 2 reports

Latestv3.9

Throws SPAM Away

Author

ウェブ屋のさとーさん

5.0(6)

100/100

Last Updated

2026-08-26 (18d ago)

Active Installs

10,000+

Downloads

388,563

Requires WP

6.0+

Requires PHP

Tested up to

WP 7.1

Created

2011-07-21 (15y ago)

This plugin was developed as a way to combat comment spam (especially from abroad). Currently, it judges spam using the following filters: Japanese Character Check: If comment does not contain Japanese characters (Hiragana, Katakana, Kanji), it is blocked. Instead of displaying an error page, it silently discards the comment and returns to the post as if nothing happened. [Can be turned ON/OFF in settings] NG Keywords Check: You can set multiple NG keywords (comma-separated). If a post contains these keywords, it is similarly discarded. Link Count Check: Blocks comments that contain more link URLs (containing ‘http’) than the allowed limit (default is 3). Honey Pot / Dummy Fields Check: Generates dummy input fields hidden from real users to catch spam bots. [Can be turned ON/OFF in settings] IP Address Check: Processes posts from specified IP addresses as spam.

View on WordPress.org