CVE-2026-115673 · Runtime
NO FIX YET · SEE WHAT TO DO
The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 outputs a commenter-supplied value on an admin spam-review screen without escaping it. An unauthenticated visitor can plant a script there that runs in the browser of an administrator who reviews flagged comments.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the CleanTalk Anti-Spam, Spam FireWall plugin before 6.91 that have administrators who review flagged comments. An attacker only needs to submit a comment, and the script runs when an administrator opens the spam-review screen. Sites without the plugin, or with it at 6.91 or later, are not affected.
Not affected if plugin-not-installed, plugin-updated-to-6.91
Who cares cleantalk, self-hosted, wordpress
wp plugin get cleantalk-spam-protect --field=version (unknown if the sources do not name the plugin slug)6.91 or laterThe Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.