CVE-2026-115673: Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

Q: Who is exposed to this issue?

WordPress sites using the Anti-Spam, Spam FireWall by CleanTalk plugin in a version earlier than 6.91 are affected. An administrator is exposed when reviewing flagged comments in the plugin's administrative spam-review screen.

Q: What does an attacker need to exploit it?

The attacker does not need to authenticate. They need to submit a comment containing a crafted value in the comment author email field and have an administrator review the flagged comment.

Q: What is the impact if exploitation succeeds?

Arbitrary web scripts can execute in the reviewing administrator's browser. The issue is stored XSS because the attacker-controlled value is retained and later rendered in the administrative review interface.

Published Nov 6, 2026

Updated

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using the Anti-Spam, Spam FireWall by CleanTalk plugin in a version earlier than 6.91 are affected. An administrator is exposed when reviewing flagged comments in the plugin's administrative spam-review screen.

What does an attacker need to exploit it?

The attacker does not need to authenticate. They need to submit a comment containing a crafted value in the comment author email field and have an administrator review the flagged comment.

What is the impact if exploitation succeeds?

Arbitrary web scripts can execute in the reviewing administrator's browser. The issue is stored XSS because the attacker-controlled value is retained and later rendered in the administrative review interface.

CVE-2026-115673: Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact if exploitation succeeds?