Anti Spam By Cleantalk Spam Protection Without Captcha
Monthly
Stored cross-site scripting in the CleanTalk Anti-Spam WordPress plugin (versions up to and including 6.88) allows unauthenticated attackers to inject malicious scripts into comment fields, which then execute for any visitor viewing the affected page. Exploitation requires the attacker to first get one comment approved from their email address; default WordPress auto-approval then allows subsequent comments to store the payload without moderation. No public exploit code or active exploitation is identified at time of analysis, and the issue is rated CVSS 5.4 Medium (CWE-79).
Stored cross-site scripting in the CleanTalk Anti-Spam WordPress plugin (versions up to and including 6.88) allows unauthenticated attackers to inject malicious scripts into comment fields, which then execute for any visitor viewing the affected page. Exploitation requires the attacker to first get one comment approved from their email address; default WordPress auto-approval then allows subsequent comments to store the payload without moderation. No public exploit code or active exploitation is identified at time of analysis, and the issue is rated CVSS 5.4 Medium (CWE-79).