Cross-Site Scripting in CleanTalk Anti-Spam Plugin for WordPress
CVE-2026-115673
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-115673?
A vulnerability in the CleanTalk Anti-Spam WordPress plugin prior to version 6.91 allows unauthenticated users to exploit the application by injecting arbitrary web scripts. The plugin fails to adequately escape user input on the administrative spam-review screen, potentially leading to the execution of these scripts in the browser of an administrator who is reviewing flagged comments. This presents a risk of malicious actions being carried out under the privileges of the administrator.
Affected Version(s)
Anti-Spam, Spam FireWall by CleanTalk 0 < 6.91
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.