Stored Cross-Site Scripting Vulnerability in Anti-Spam by CleanTalk Plugin for WordPress
CVE-2026-109198

7.2HIGH

Key Information:

Vendor

WordPress
Status
Cleantalk Anti-spam – Complete Spam Protection
Vendor
CVE Published:
23 October 2026

What is CVE-2026-109198?

The Anti-Spam by CleanTalk plugin for WordPress is susceptible to Stored Cross-Site Scripting via the 'user_email' parameter due to inadequate input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious web scripts into pages. When user registration is enabled, these scripts execute when an Administrator runs a user-spam scan and views spam-related tabs in the plugin. This highlights the importance of ensuring proper data sanitization and security measures are in place while using the plugin.

Affected Version(s)

CleanTalk Anti-Spam – Complete Spam Protection 0 <= 6.89.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/cleantalk-spam...
https://plugins.trac.wordpress.org/browser/cleantalk-spam...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo
.