Vulnerabilities / Anti-Spam by CleanTalk / WPSEC-2026-1066
Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via User Email
Medium 6.1
CWE-79Fixed in 6.90
- ID
- WPSEC-2026-1066
- Plugin
- Spam Protection for Forms & Comments. Anti-Spam by CleanTalk (cleantalk-spam-protect)
- Affected
- all versions before 6.90
- Remediation
- Update to 6.90 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-16
- Attack surface
- Anti-Spam by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Spam Protection for Forms & Comments. Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via user email addresses and stored IP addresses in all versions up to, and including, 6.89.1 due to insufficient output escaping in the Find Spam users list tables. This makes it possible for unauthenticated attackers, when user registration is enabled, to register an account with a crafted email address that injects arbitrary web scripts which execute when an administrator views the spam users check pages.
References
- https://wpsec.com/vuln/WPSEC-2026-1066/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.90/
- https://wordpress.org/plugins/cleantalk-spam-protect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS