Vulnerabilities / Anti-Spam by CleanTalk / WPSEC-2026-1065
Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Reflected Cross-Site Scripting via 'item_meta' Parameter
Medium 6.1
CWE-79Fixed in 6.90
- ID
- WPSEC-2026-1065
- Plugin
- Spam Protection for Forms & Comments. Anti-Spam by CleanTalk (cleantalk-spam-protect)
- Affected
- all versions before 6.90
- Remediation
- Update to 6.90 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-16
- Attack surface
- Anti-Spam by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Spam Protection for Forms & Comments. Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'item_meta' parameter in the Formidable Forms integration in all versions up to, and including, 6.89.1 due to an unvalidated array key from the request being used as a key in the blocking response that is echoed without HTML-safe encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into submitting a crafted request, on sites using Formidable Forms.
References
- https://wpsec.com/vuln/WPSEC-2026-1065/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.90/
- https://wordpress.org/plugins/cleantalk-spam-protect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS