CleanTalk Anti-Spam EUVD-2026-96064

Exploitation requires that site comments be enabled and that the attacker first have one comment approved from their email address; on default WordPress installations only the first comment per email is held for moderation, after which subsequent comments auto-approve and the unsanitized 'comment' value is stored and output to visitors. The limiting factors are this initial moderation gate (the basis for AC:H) and the dependence on standard WordPress comment auto-approval behavior - sites that require manual approval of all comments, disable comments, or use additional moderation would substantially blunt exploitation. No authentication is required (PR:N), and the payload fires on ordinary page views without special attacker-controlled user interaction.

This is a stored XSS (CWE-79) in the CleanTalk Anti-Spam WordPress plugin (≤6.88), assessed by Wordfence at CVSS 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N. The signals are internally consistent and point to a real but moderate-priority issue rather than a critical one. On the exploitability side: network vector (AV:N) and no privileges (PR:N) mean unauthenticated remote attackers can reach it, which raises concern; however, AC:H is justified because exploitation is gated on a precondition - the attacker's comment must first be approved, and on default WordPress only the first comment from a given email is moderated before subsequent ones auto-approve. The scope change (S:C) plus low confidentiality/integrity impact (C:L/I:L, A:N) correctly captures that the payload executes in visitors' browser context, not on the server. No EPSS score, KEV listing, or public POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a genuine, broadly-reachable unauthenticated stored-XSS worth patching promptly on affected sites, but the Medium severity, moderation precondition, and absence of any exploitation/POC signal argue against emergency prioritization over higher-CVSS or KEV-listed items.

An unauthenticated attacker submits a blog/post comment containing a malicious script in the 'comment' field; after an initial comment from their email is approved, default WordPress auto-approves their subsequent comments, so the XSS payload is stored and rendered to every visitor who views that page. No public exploit code was identified at time of analysis, and the attack is throttled by the one-time moderation step (reflected in AC:H).