CVE-2026-48876: WordPress Stop Spammers plugin <= 2026.3 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored cross-site scripting (XSS) vulnerability in the Stop Spammers WordPress plugin, versions 2026.3 and earlier. The vulnerability is reachable over the network and requires no authentication, but a victim must take an action (such as clicking a crafted link) for the attack to succeed. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, enabling session theft, page content manipulation, or redirection to malicious sites. HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationNot required

  No account or session credentials are needed; the vulnerability is exploitable by any unauthenticated external party.

• Victim interactionRequired

  A victim must perform an action, such as clicking a crafted link or visiting a malicious page, for the injected script to execute in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental factors beyond delivering the payload to the victim.

Blast Radius

• Reads session cookies and authentication tokens from the victim's browser, enabling account hijacking.
• Modifies the content of the page rendered in the victim's browser, allowing phishing overlays or credential-harvesting forms to be injected.
• Redirects the victim's browser to an attacker-controlled site.
• Degrades the victim's browsing session by injecting disruptive or misleading UI elements (partial availability impact within the browser context).