Stored Cross-Site Scripting Vulnerability in CleanTalk Plugin for WordPress
CVE-2026-103424

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Anti-spam By Cleantalk – Spam Protection Without Captcha
Vendor
CVE Published:
10 October 2026

What is CVE-2026-103424?

The Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'comment' parameter. This issue allows unauthenticated attackers to insert arbitrary scripts into comments approved by the site. On default WordPress installations, the first comment from a new email address is held for moderation, but subsequent comments are auto-approved, exposing site visitors to potential script execution whenever the malicious comment is accessed.

Affected Version(s)

Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA 0 <= 6.88

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/cleantalk-spam...
https://plugins.trac.wordpress.org/browser/cleantalk-spam...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Maciej Komorowski
.