Cleantalk Anti Spam Complete Spam Protection
Monthly
Stored cross-site scripting in CleanTalk Anti-Spam for WordPress (all versions through 6.89.1) lets an unauthenticated visitor submit a crafted 'user_email' value during registration and have arbitrary script execute in an administrator's browser when the plugin's user-spam scan is run and the Non-checkable users or Spam users tab is opened. Exploitation is gated by two conditions: site user registration must be open, and an administrator must perform that scan/view step, so the issue is not reachable on default configurations lacking those. No public exploit has been identified at time of analysis; the vendor rates it 7.2 (High) with scope change, and our assessed vector agrees on AV:N/AC:L/PR:N/S:C/C:L/I:L/A:N but uses UI:R rather than UI:N because the administrator's scan/view action is required.
Stored cross-site scripting in CleanTalk Anti-Spam for WordPress (all versions through 6.89.1) lets an unauthenticated visitor submit a crafted 'user_email' value during registration and have arbitrary script execute in an administrator's browser when the plugin's user-spam scan is run and the Non-checkable users or Spam users tab is opened. Exploitation is gated by two conditions: site user registration must be open, and an administrator must perform that scan/view step, so the issue is not reachable on default configurations lacking those. No public exploit has been identified at time of analysis; the vendor rates it 7.2 (High) with scope change, and our assessed vector agrees on AV:N/AC:L/PR:N/S:C/C:L/I:L/A:N but uses UI:R rather than UI:N because the administrator's scan/view action is required.