What is the CVSS score of EUVD-2026-35986?

EUVD-2026-35986 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Anti-Spam by CleanTalk are affected by EUVD-2026-35986?

The Anti-Spam by CleanTalk Spam Protection WordPress plugin before version 6.79 contains a stored JavaScript injection vulnerability that allows remote attackers without authentication to inject…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-35986?

Yes, a public proof-of-concept exploit is available for EUVD-2026-35986. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-35986?

24 hours: Inventory all WordPress installations and identify those running Anti-Spam by CleanTalk prior to version 6.79; escalate to emergency security protocol. 7 days: Update all affected installations to version 6.79 or later; validate successful deployment across all instances. 30 days: Conduct comprehensive security audit of previously vulnerable installations for evidence of JavaScript injection, unauthorized comments, or suspicious administrator account access during the exposure window.

Anti-Spam by CleanTalk EUVD-2026-35986

| CVE-2026-8071 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-10 WPScan

GHSA-jqmp-cmj4-fv28

XSS WordPress Anti Spam By Cleantalk Spam Protection

8.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 11:22 vuln.today

CVSS changed

Jun 10, 2026 - 11:22 NVD

8.8 (HIGH)

Patch available

Jun 10, 2026 - 08:01 EUVD

CVE Published

Jun 10, 2026 - 06:00 nvd

HIGH 8.8

CVE Published

Jun 10, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 2 Critical, 3 With POC Jun 11, 2026

AnalysisAI

Stored cross-site scripting in the Anti-Spam by CleanTalk Spam Protection WordPress plugin before 6.79 allows unauthenticated remote attackers to inject arbitrary JavaScript into approved comments via a custom shortcode in the email-encoding feature, with execution occurring when any visitor or administrator views the affected post. Publicly available exploit code exists per WPScan, increasing exposure for the plugin's large WordPress installation base, though it requires user interaction (UI:R) to trigger the payload. The high CVSS score of 8.8 reflects the potential for administrator account compromise leading to full site takeover.

Technical ContextAI

The vulnerability resides in the email-encoding feature of the Anti-Spam by CleanTalk plugin (CPE cpe:2.3:a:unknown:anti-spam_by_cleantalk._spam_protection), which exposes a custom shortcode that fails to sanitize user-supplied content before rendering it in the comment context. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-supplied HTML and JavaScript embedded inside the shortcode passes through to the rendered DOM without escaping or filtering. Because WordPress shortcodes are expanded server-side at page render, the malicious script becomes a persistent (stored) XSS payload tied to an approved comment, executing in any visitor's browser within the trusted origin of the WordPress site.

RemediationAI

Upgrade the Anti-Spam by CleanTalk Spam Protection plugin to version 6.79 or later, which is the vendor-released patch confirmed by the WPScan advisory (https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/) and the EUVD record. If immediate patching is not possible, compensating controls include moderating all incoming comments manually to prevent untrusted shortcode payloads from being approved (trade-off: increased administrative overhead and delayed legitimate comments), temporarily deactivating the plugin's email-encoding feature or the plugin itself if comment spam protection can be substituted (trade-off: loss of anti-spam coverage exposing the site to comment spam flooding), and deploying a Web Application Firewall rule to block shortcode payloads containing script tags or JavaScript event handlers in comment submissions (trade-off: potential false positives on legitimate technical discussions). Audit existing approved comments for malicious shortcode content even after upgrading, since stored XSS payloads persist in the database.