Oopspam Anti Spam Vulnerabilities

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.62 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVSS:

7.2

Affected:

up to 1.2.62

Fixed in:

1.2.63

Disclosed:

Mar 23, 2026

CVE-2026-32544 on NVD →

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to IP Header Spoofing in all versions up to, and including, 1.2.53. This is due to the plugin trusting client-controlled forwarded headers (such as CF-Connecting-IP, X-Forwarded-For, and others) without...

CVSS:

5.3

Affected:

up to 1.2.53

Fixed in:

1.2.54

Disclosed:

Oct 30, 2025

CVE-2025-12094 on NVD →

The OOPSpam Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.44. This is due to missing or incorrect nonce validation on the 'empty_ham_entries' and 'empty_spam_entries' functions. This makes it possible for unauthenticated attackers to delete both spam an...

CVSS:

5.4

Affected:

up to 1.1.45

Fixed in:

1.1.45

Disclosed:

Jun 21, 2023

CVE-2023-35913 on NVD →

The OOPSpam Anti-Spam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via options such as 'oopspam_wpregister_spam_message', 'oopspam_woo_spam_message', and 'oopspam_give_spam_message' (as well as numerous others) in versions up to, and including, 1.1.35 due to insufficient input sanitization and outp...

CVSS:

5.5

Affected:

up to 1.1.35

Fixed in:

1.1.36

Disclosed:

Jan 17, 2023

CVE-2023-22716 on NVD →