SpamBlock Vulnerable to Reflected Cross-Site Scripting

CVE-2024-9647

Summary

The Kama SpamBlock plugin for WordPress contains a vulnerability that allows attackers to exploit reflected cross-site scripting through insufficient input sanitization and output escaping. This vulnerability impacts all versions of the plugin up to and including version 1.8.2. An attacker can leverage this flaw by tricking a user into interacting with a malicious link, which subsequently enables them to inject arbitrary web scripts into the web application. This poses significant security risks to users and the integrity of the website, as attackers can manipulate pages viewed by users.

References