The Comment SPAM Wiper plugin for WordPress stores the value of the "API Key" setting without performing proper input validation or output escaping. The plugin subsequently renders this value on every page, so an authenticated user with Administrator or higher privileges can inject arbitrary JavaScript that will be executed in the browsers of any visitor who loads a page containing the stored value. This stored Cross‑Site Scripting flaw allows the attacker to run client‑side code that could harvest data, manipulate page content, or perform actions on behalf of the user, but only when the plugin’s configuration is displayed.

The vulnerability affects the intermod Comment SPAM Wiper plugin for WordPress in all releases up to and including version 1.2.1. It applies to multi‑site installations where the unfiltered_html capability is disabled, and does not affect other WordPress components or plugins.

The CVSS base score of 4.4 indicates a moderate impact if the conditions are met. No EPSS data is available and the flaw is not listed in the CISA KEV catalog. Exploitation requires an account with Administrator or higher privileges to modify the "API Key" field; once the malicious payload is stored, it will automatically execute for all site visitors without additional action. The risk is confined to sites that enable the plugin under the specified conditions, but the impact of successful exploitation is the full range of cross‑site scripting attacks on site users.