CVE-2026-8071
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in the Anti-Spam by CleanTalk WordPress plugin before version 6.79: improper content sanitization in a custom shortcode used in email encoding. Unauthenticated attackers can inject arbitrary web scripts into approved comments.
Risk Assessment
Scripts execute when any user (including administrators) views the post, potentially leading to session theft or defacement.
Recommendation
Update the Anti-Spam by CleanTalk plugin to version 6.79 or later.
Other vulnerabilities in Anti-Spam by CleanTalk
See all- CVE-2026-103424Medium
The Anti-Spam by CleanTalk plugin for WordPress up to version 6.88 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is exploitable once a comment from the attacker's email is approved; on default WordPress installations, only the first comment from a given email is moderated, and subsequent comments auto-approve.
- CVE-2026-10770Medium
The Anti-Spam by CleanTalk plugin for Drupal contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from 0.0.0 to 9.7.1.
Original NVD description (English source)
The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS