CVE-2026-32544
Stored XSS in OOPSpam Anti-Spam Allows Persistent Script Injection
Publication date: 2026-03-25
Last updated on: 2026-03-25
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oopspam_team | oopspam_anti-spam | to 1.2.62 (inc) |
| oopspam | oopspam_anti_spam | From 1.0.0 (inc) to 1.2.62 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-32544 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-32544 is a medium severity Cross Site Scripting (XSS) vulnerability affecting the WordPress OOPSpam Anti-Spam Plugin versions up to and including 1.2.62.
This vulnerability allows attackers to inject malicious scripts, such as redirects, advertisements, or other HTML payloads, into websites using the affected plugin.
These malicious scripts execute when visitors access the compromised site, potentially enabling widespread exploitation.
Exploitation requires user interaction by a privileged user, such as clicking a malicious link, visiting a crafted page, or submitting a form, but no authentication is required to initiate the attack.
The vulnerability falls under the OWASP Top 10 category A3: Injection.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject and execute malicious scripts on your website.
- Injected scripts can perform redirects to malicious sites.
- Attackers can display unwanted advertisements or other harmful HTML content.
- Visitors to your site may be exposed to these malicious payloads, potentially damaging your site's reputation and user trust.
- The vulnerability can be exploited on a large scale, affecting many websites regardless of their traffic or popularity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The CVE-2026-32544 vulnerability is a Cross Site Scripting (XSS) flaw in the OOPSpam Anti-Spam Plugin up to version 1.2.62. Detection typically involves monitoring for injected malicious scripts such as redirects, advertisements, or other HTML payloads in web pages generated by the plugin.
While specific commands are not provided, detection can include inspecting HTTP responses for suspicious script injections or using web vulnerability scanners that test for stored XSS vulnerabilities targeting the affected plugin.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, update the OOPSpam Anti-Spam Plugin to version 1.2.63 or later, where the issue has been patched.
If updating immediately is not possible, apply the mitigation rule provided by Patchstack to block attacks until the update can be performed.
Users unable to update or apply the mitigation rule should seek assistance from their hosting provider or web developer.