Description

Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:16:57.433Z",
  "pubdate": "2026-08-13T14:16:57.433Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Maspik – Spam blacklist plugin for WordPress, specifically affecting versions 2.9.1 and prior.\nThe vulnerability arises from improper handling of user-supplied input, allowing remote attackers to inject malicious JavaScript into web pages rendered to unsuspecting users.\nSuccessful exploitation of this flaw can lead to severe security implications, including session hijacking, credential theft, unauthorized actions performed on behalf of authenticated administrators, and further client-side compromise of the targeted WordPress site.\nThe attack requires no prior authentication, lowering the barrier to entry for malicious actors scanning for vulnerable endpoints.\nExploitation typically involves tricking a user or administrator into interacting with a specially crafted URL containing the malicious payload, which is then reflected and executed within the context of the victim's browser session.",
  "technicalDetails": "The vulnerability exists due to insufficient sanitization and output encoding of parameters handled by the Maspik – Spam blacklist plugin within versions 2.9.1 and below.\nAs an unauthenticated Cross-Site Scripting (XSS) vulnerability, it exhibits network exposure over HTTP/HTTPS protocols, allowing any remote unauthenticated attacker to interact with the vulnerable application endpoints.\nThe root cause is the lack of proper context-aware output encoding when reflecting HTTP request parameters back to the client in the Document Object Model (DOM).\nDuring the attack flow, the attacker crafts a malicious URI containing an arbitrary JavaScript payload injected into vulnerable parameters processed by the plugin.\nWhen an unauthenticated or authenticated user accesses the crafted URL, the server processes the request and improperly reflects the unsanitized payload within the HTTP response.\nUpon receiving the response, the victim's browser executes the embedded JavaScript payload within the security context of the origin site.\nBecause the execution occurs client-side, the script inherits the privileges of the victim session.\nIf the victim is an administrative user, the payload can perform privileged actions such as creating new rogue administrator accounts, modifying plugin configurations, or executing arbitrary code via the WordPress dashboard.\nPost-exploitation impact includes session token theft via document.cookie access, DOM manipulation, keylogging, and redirection to malicious external phishing or exploit distribution infrastructure."
}