The Stop Spammers Classic WordPress plugin fails to properly escape single quotes in the author POST parameter. Even after sanitize_text_field, the value is stored in the ss_stop_sp_reg_stats option and later injected into a single‑quoted JavaScript string inside an onclick attribute using esc_js(). Because esc_js() does not escape single quotes, an attacker can break out of the string literal and execute arbitrary JavaScript when an administrator clicks the "Report to SFS" link on a poisoned log entry.

The vulnerability affects the webguyio:Stop Spammers Classic plugin for WordPress, versions 2026.6 and earlier.

The flaw has a CVSS score of 4.7, indicating a medium risk level. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Successful exploitation requires that an unauthenticated attacker submits a malicious author value and that a user with administrative permissions with manage_options capability later clicks the vulnerable link. The attack vector is web‑based, stored XSS, and requires an action by an administrator to realize the impact.