The Project Honey Pot Spam Trap WordPress plugin fails to validate a nonce in its printAdminPage() function. Because the verification is missing or incorrect, an attacker can send a forged request that updates the plugin’s settings and injects malicious script code. The resulting stored XSS is executed whenever an administrator views the injected content, allowing the attacker to execute arbitrary client‑side code in the context of the site. This can lead to session hijacking, defacement, or other injection‑based attacks, compromising the integrity and confidentiality of the site’s administrative interface.

WordPress users running the Project Honey Pot Spam Trap plugin version 1.0.1 or earlier are affected. All installations of this plugin up to and including 1.0.1 have the missing nonce check in printAdminPage().

The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of less than 1% signifies low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. An attacker must trick a site administrator into executing a forged request—typically by clicking a malicious link—since the vulnerability is unauthenticated. Once the forged request is sent, the plugin will accept the malicious script and store it, leading to an immediate XSS risk.