CVE-2026-8071: Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass
The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Anti-Spam by CleanTalkto a version that resolves this vulnerability.Fixed in 6.79 - Remove
Remove
Anti-Spam by CleanTalkfrom your environment.Uninstall the Anti-Spam by CleanTalk plugin if it is not required.
- Configuration
Disable the plugin's custom email-encoding shortcode/feature to prevent rendering of encoded shortcodes until the plugin is updated to 6.79 or later.
Anti-Spam by CleanTalk (email-encoding shortcode) email-encoding shortcode = disabled - Configuration
Require manual approval for new comments or disable automatic approval so untrusted/unauthenticated comments are not published until the plugin is updated.
WordPress (comments) comment approval/moderation = require manual approval / disable auto-approval - Compensating control
If you cannot immediately update or disable the feature, use application controls or a WAF to block or sanitize incoming comment content and/or temporarily disable public comment submission from unauthenticated users until the plugin is updated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8071?
CVE-2026-8071 has a high severity with a CVSS score of 8.8.
How do I fix CVE-2026-8071?
To fix CVE-2026-8071, update the CleanTalk Anti-Spam plugin to version 6.79 or later.
What type of vulnerability is CVE-2026-8071?
CVE-2026-8071 is an unauthenticated stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-8071?
Users of the CleanTalk Anti-Spam by CleanTalk plugin prior to version 6.79 are affected by CVE-2026-8071.
Can CVE-2026-8071 allow attackers to inject scripts?
Yes, CVE-2026-8071 allows unauthenticated attackers to inject arbitrary web scripts into approved comments.