EUVD-2026-35986
GHSA-jqmp-cmj4-fv28
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site with vulnerable CleanTalk plugin
-
DeliverySubmit comment with malicious email-encoding shortcode
-
ExploitComment approved through moderation or auto-approval
-
InstallAdministrator views affected post
-
C2Shortcode renders unsanitized JavaScript
-
ExecutePayload executes in admin browser session
-
ImpactSession hijack or admin account creation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Anti-Spam by CleanTalk Spam Protection plugin to be installed and active at a version below 6.79 on a WordPress site that accepts comments, with the custom shortcode used by the email-encoding feature processed on rendered pages. The attacker must submit a comment that gets approved (either via auto-approval settings or moderator action), and a victim (any post viewer, with maximum impact when an administrator) must subsequently load the post containing the stored payload, satisfying the CVSS UI:R requirement. No attacker authentication is required (PR:N), but successful admin compromise depends on an authenticated administrator viewing the affected post in a browser session, which limits exploitation to sites where admins actively review comments or content. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity, unauthenticated attack requiring user interaction, scoring 8.8. The high C/I/A impact ratings reflect the WordPress administrator takeover scenario typical for stored XSS in comment threads. Publicly available exploit code (per WPScan) raises practical risk, but the vulnerability is NOT listed in CISA KEV and no EPSS score was provided in the input, so the real-world exploitation tempo is not independently confirmed. The UI:R requirement (an administrator or viewer must load the affected post) tempers immediacy compared to zero-click flaws, but stored XSS in a high-installation-base anti-spam plugin offers a reliable path to admin compromise, making this a priority patch for WordPress operators running CleanTalk. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a comment containing the vulnerable CleanTalk email-encoding shortcode wrapped around malicious JavaScript; once the comment passes spam filtering and is approved (either automatically or by a moderator), the payload is stored in the database. When an administrator subsequently views the post containing the approved comment, the shortcode is expanded server-side and the attacker's JavaScript executes in the admin's authenticated browser session, allowing session theft, CSRF-based plugin installation, or creation of a new administrative user. Publicly available exploit code via WPScan lowers the technical barrier for this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Stored cross-site scripting in the Anti-Spam by CleanTalk Spam Protection WordPress plugin before 6.79 allows unauthenticated remote attackers to inject arbitrary JavaScript into approved comments via a custom shortcode in the email-encoding feature, with execution occurring when any visitor or administrator views the affected post. Publicly available exploit code exists per WPScan, increasing exposure for the plugin's large WordPress installation base, though it requires user interaction (UI:R) to trigger the payload. The high CVSS score of 8.8 reflects the potential for administrator account compromise leading to full site takeover.
RemediationAI
Upgrade the Anti-Spam by CleanTalk Spam Protection plugin to version 6.79 or later, which is the vendor-released patch confirmed by the WPScan advisory (https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/) and the EUVD record. If immediate patching is not possible, compensating controls include moderating all incoming comments manually to prevent untrusted shortcode payloads from being approved (trade-off: increased administrative overhead and delayed legitimate comments), temporarily deactivating the plugin's email-encoding feature or the plugin itself if comment spam protection can be substituted (trade-off: loss of anti-spam coverage exposing the site to comment spam flooding), and deploying a Web Application Firewall rule to block shortcode payloads containing script tags or JavaScript event handlers in comment submissions (trade-off: potential false positives on legitimate technical discussions). Audit existing approved comments for malicious shortcode content even after upgrading, since stored XSS payloads persist in the database.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the email-encoding feature of the Anti-Spam by CleanTalk plugin (CPE cpe:2.3:a:unknown:anti-spam_by_cleantalk._spam_protection), which exposes a custom shortcode that fails to sanitize user-supplied content before rendering it in the comment context. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-supplied HTML and JavaScript embedded inside the shortcode passes through to the rendered DOM without escaping or filtering. Because WordPress shortcodes are expanded server-side at page render, the malicious script becomes a persistent (stored) XSS payload tied to an approved comment, executing in any visitor's browser within the trusted origin of the WordPress site.
Know when Anti Spam By Cleantalk Spam Protection gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.
Articles & Coverage 1
Executive ViewAI
The Anti-Spam by CleanTalk Spam Protection WordPress plugin before version 6.79 contains a stored JavaScript injection vulnerability that allows remote attackers without authentication to inject malicious code into website comments. When site visitors or administrators view affected posts, the injected code automatically executes in their browsers, enabling account compromise and full website takeover. With publicly available exploit code in circulation, this represents immediate critical risk to all WordPress installations using vulnerable versions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB