Vulnerability · Published Jun 10, 2026 · Assigned by WPScan
CVE-2026-8071Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass
High 8.8
In plain English
A high-severity cross-site scripting in Anti-Spam by CleanTalk. Spam protection from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 64.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Anti-Spam by CleanTalk. Spam protection | 0 – before 6.79 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/ exploit, vdb-entry, technical-description