CleanTalk Anti-Spam CVE-2026-109198

Two concrete preconditions must hold: (1) WordPress user registration must be open on the target site, allowing an unauthenticated attacker to create an account and submit the malicious 'user_email' value - this is not the WordPress default; and (2) an Administrator must subsequently run CleanTalk's user-spam scan and open the Non-checkable users or Spam users tab, the plugin's own documented workflow, which is the point where the stored script executes. The attacker needs no authentication, but exploitation is limited by the non-default open-registration requirement and the dependency on an administrator performing the scan/view action; impact is bounded to the injected admin page context (C:L/I:L, no availability impact).

This is a scope-changed stored XSS (CWE-79) carrying a vendor CVSS 3.1 base score of 7.2 (High) via CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The network vector and PR:N correctly reflect that an unauthenticated attacker supplies the payload, but PR:N is gated by a configuration precondition (open user registration) and the vendor vector's UI:N is in tension with the described mechanism: execution only occurs when an Administrator runs the plugin's user-spam scan and opens the Non-checkable/Spam users tab, which is effectively a required action by another user - arguably UI:R. S:C and the C:L/I:L impacts are consistent with script executing in the admin's authenticated browser context rather than full site compromise. No EPSS score, no SSVC decision record, and no KEV listing were provided; the vuln.today decision label is 'this_week', indicating prioritized but not emergency handling. The references are Wordfence's advisory plus WordPress trac source-line and changeset links - these are vulnerability-location and fix-commit references, not verified working exploit code. Netting these signals: a genuine but conditionally-gated issue (two preconditions: open registration and admin interaction) that warrants scheduled patching rather than emergency response. Missing EPSS/SSVC data limits precision on exploitation likelihood.

On a WordPress site with open user registration, an unauthenticated attacker registers an account supplying a crafted 'user_email' value containing a script payload, which is stored without sanitization. When an administrator later runs CleanTalk's user-spam scan and opens the Non-checkable users or Spam users tab, the stored script executes in the administrator's authenticated session. No public exploit code is identified; Wordfence published the affected source locations but not a working exploit.