# Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Reflected Cross-Site Scripting via 'item_meta' Parameter

- **ID:** WPSEC-2026-1065
- **Plugin:** Spam Protection for Forms & Comments. Anti-Spam by CleanTalk (`cleantalk-spam-protect`), https://wordpress.org/plugins/cleantalk-spam-protect/
- **Affected versions:** all versions before 6.90
- **Fixed in:** 6.90 (Update to 6.90 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1065/

## Description

The Spam Protection for Forms & Comments. Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'item_meta' parameter in the Formidable Forms integration in all versions up to, and including, 6.89.1 due to an unvalidated array key from the request being used as a key in the blocking response that is echoed without HTML-safe encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into submitting a crafted request, on sites using Formidable Forms.

## References

- https://wpsec.com/vuln/WPSEC-2026-1065/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.90/
- https://wordpress.org/plugins/cleantalk-spam-protect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1065/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.