# Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via User Email

- **ID:** WPSEC-2026-1066
- **Plugin:** Spam Protection for Forms & Comments. Anti-Spam by CleanTalk (`cleantalk-spam-protect`), https://wordpress.org/plugins/cleantalk-spam-protect/
- **Affected versions:** all versions before 6.90
- **Fixed in:** 6.90 (Update to 6.90 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cleantalk-spam-protect
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1066/

## Description

The Spam Protection for Forms & Comments. Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via user email addresses and stored IP addresses in all versions up to, and including, 6.89.1 due to insufficient output escaping in the Find Spam users list tables. This makes it possible for unauthenticated attackers, when user registration is enabled, to register an account with a crafted email address that injects arbitrary web scripts which execute when an administrator views the spam users check pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-1066/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.90/
- https://wordpress.org/plugins/cleantalk-spam-protect/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1066/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.