The vulnerability permits an attacker to inject a script into the WordPress Spam Blocker plugin’s storage, which is later executed for every visitor to the affected pages. The issue arises because the plugin does not neutralize input before rendering, leading to a classic input‑validation flaw classified as CWE‑79. Inferred from the description, an attacker can exploit this via a CSRF technique, allowing the malicious payload to be stored without requiring administrative credentials. This stored XSS can compromise user sessions, deface content, or redirect users to phishing sites.

All WordPress installations that include the Ankit Singla WordPress Spam Blocker plugin at version 2.0.5 or earlier are affected. The vulnerability is confined to these plugin versions; other WordPress builds or newer plugin versions are unaffected.

The CVSS score of 7.1 indicates high severity, yet the EPSS score of less than 1% suggests current exploitation attempts are rare. The vulnerability is not listed in CISA KEV. Attackers can exploit this by crafting a CSRF request that triggers the plugin’s unsanitized input handling, thus persisting malicious code that will execute in any user’s browser when the site page is rendered. The primary vector is the web interface, with potential indirect exposure to external users of the site.