Spam Protection Honeypot Anti Spam By Cleantalk
Monthly
Stored cross-site scripting in the CleanTalk Spam Protection, Honeypot, Anti-Spam WordPress plugin (all versions through 6.86) allows injection of arbitrary JavaScript via unescaped aria-label attributes rendered from comment content by the plugin's ContactsEncoder component. The unauthenticated comment submission path makes the payload deliverable without credentials, though script execution is limited to non-logged-in visitors, and sites with comment moderation enabled require an administrator to approve the comment before it reaches other users. Version 6.87 contains the confirmed fix per WordPress SVN changeset 3677388; no public exploit code or CISA KEV entry is identified at time of analysis.
Stored cross-site scripting in the CleanTalk Spam Protection, Honeypot, Anti-Spam WordPress plugin (all versions through 6.86) allows injection of arbitrary JavaScript via unescaped aria-label attributes rendered from comment content by the plugin's ContactsEncoder component. The unauthenticated comment submission path makes the payload deliverable without credentials, though script execution is limited to non-logged-in visitors, and sites with comment moderation enabled require an administrator to approve the comment before it reaches other users. Version 6.87 contains the confirmed fix per WordPress SVN changeset 3677388; no public exploit code or CISA KEV entry is identified at time of analysis.