The plugin contains improper neutralization of input during web page generation, allowing stored cross‑site scripting. Malicious payloads entered via the plugin’s input can be persisted in the site’s content or settings and later rendered in the browser, potentially enabling attackers to execute arbitrary JavaScript. This can lead to cookie theft, session hijacking, defacement, or redirection for a victim who visits the affected page.

WordPress sites that have the Block Spam By Math Reloaded plugin installed, any version from the initial release through and including 2.2.4, are vulnerable. Site administrators should verify the plugin version and whether it remains within that vulnerable range. All hosted WordPress instances that load the plugin into public pages are at risk.

The CVSS score of 5.9 classifies the vulnerability as medium severity, while the EPSS score indicates a very low but non‑zero likelihood of exploitation at this time. The issue is not listed in the CISA KEV catalog, which suggests that publicly known exploits are either not yet observed or not yet reported. Attackers can exploit the flaw by injecting a malicious script into the plugin’s input fields; when a visitor loads the affected page the script runs in the context of the site, allowing the attacker to gather session data or perform other client‑side attacks.