Block Spam By Math Reloaded Vulnerabilities

The Block Spam By Math Reloaded plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on one of its functions in versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to invoke this function intended for users with higher-level pri...

CVSS:

5.3

Affected:

up to 2.2.4

Fix:

No patched version reported

Disclosed:

Mar 11, 2025

CVE-2025-28872 on NVD →

The Block Spam By Math Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scr...

CVSS:

4.4

Affected:

up to 2.2.4

Fix:

No patched version reported

Disclosed:

Mar 11, 2025

CVE-2025-28871 on NVD →

[en] Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Block Spam By Math Reloaded: from n/a through 2.2.4.

Affected:

up to 2.2.4

Fix:

No patched version reported

Disclosed:

Mar 11, 2025

CVE-2025-28872 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded allows Stored XSS. This issue affects Block Spam By Math Reloaded: from n/a through 2.2.4.

Affected:

up to 2.2.4

Fix:

No patched version reported

Disclosed:

Mar 11, 2025

CVE-2025-28871 on NVD →

BYPASS vulnerability was discovered in WordPress Block Spam By Math Reloaded plugin. Update the plugin.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Aug 20, 2011