{"id":"CVE-2026-115673","kind":"vulnerability","aliases":["CVE-2026-115673"],"related":[],"title":"CleanTalk Anti-Spam WordPress plugin: unescaped comment value runs script in admin browser","description":"The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.","summary":"The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 outputs a commenter-supplied value on an admin spam-review screen without escaping it. An unauthenticated visitor can plant a script there that runs in the browser of an administrator who reviews flagged comments.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cleantalk","runtime","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated-to-6.91"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get cleantalk-spam-protect --field=version` (unknown if the sources do not name the plugin slug)\n- Look for the plugin on sites where administrators review flagged comments in the spam queue","fix":"- CleanTalk Anti-Spam plugin: move to `6.91` or later","status":"open","published_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:41:57+00:00","updated_at":"2026-11-06T06:41:57+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-06T06:41:57Z","model":"claude-haiku-5-5","output":{"fix":"- CleanTalk Anti-Spam plugin: move to `6.91` or later","reach":"internet","title":"CleanTalk Anti-Spam WordPress plugin: unescaped comment value runs script in admin browser","impact":"medium","summary":"The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 outputs a commenter-supplied value on an admin spam-review screen without escaping it. An unauthenticated visitor can plant a script there that runs in the browser of an administrator who reviews flagged comments.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","cleantalk","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Administrator browser runs attacker script, enabling admin session takeover","analyst_note":"Confirm the plugin slug and whether the NVD entry or vendor changelog names the 6.91 fix; sources gave no severity score.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get cleantalk-spam-protect --field=version` (unknown if the sources do not name the plugin slug)\n- Look for the plugin on sites where administrators review flagged comments in the spam queue","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-updated-to-6.91","plugin-not-installed"],"who_is_affected":"Sites running the CleanTalk Anti-Spam, Spam FireWall plugin before 6.91 that have administrators who review flagged comments. An attacker only needs to submit a comment, and the script runs when an administrator opens the spam-review screen. Sites without the plugin, or with it at 6.91 or later, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4240,"output_tokens":657,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115673':17A,20A '-2026':16A,19A '6.91':38B,86C 'admin':13A,47B 'administr':70B,100C,120C 'allow':105C 'anti':3A,29B,77C 'anti-spam':2A,28B,76C 'arbitrari':110C 'browser':14A,67B,117C 'cleantalk':1A,21B,34B,82C 'comment':8A,42B,74B,92C,124C 'commenter-suppli':41B,91C 'cve':15A,18A 'escap':53B,89C 'execut':114C 'firewal':32B,80C 'flag':73B,123C 'host':25B 'inject':109C 'output':39B,96C 'plant':59B 'plugin':6A,36B,84C 'review':50B,72B,103C,122C 'run':10A,64B 'runtim':22B 'screen':51B,104C 'script':11A,61B,112C 'self':24B 'self-host':23B 'spam':4A,30B,31B,49B,78C,79C,102C 'spam-review':48B,101C 'suppli':43B,93C 'unauthent':56B,106C 'unescap':7A 'user':107C 'valu':9A,44B,94C 'visitor':57B 'web':111C 'without':52B 'wordpress':5A,26B,35B,83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the CleanTalk Anti-Spam, Spam FireWall plugin before 6.91 that have administrators who review flagged comments. An attacker only needs to submit a comment, and the script runs when an administrator opens the spam-review screen. Sites without the plugin, or with it at 6.91 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cleantalk","medium","runtime","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-115673':17A,20A '-2026':16A,19A 'admin':13A 'anti':3A 'anti-spam':2A 'browser':14A 'cleantalk':1A 'comment':8A 'cve':15A,18A 'plugin':6A 'run':10A 'script':11A 'spam':4A 'unescap':7A 'valu':9A 'wordpress':5A","search_b":"'6.91':38B 'admin':47B 'administr':70B 'anti':29B 'anti-spam':28B 'browser':67B 'cleantalk':21B,34B 'comment':42B,74B 'commenter-suppli':41B 'escap':53B 'firewal':32B 'flag':73B 'host':25B 'output':39B 'plant':59B 'plugin':36B 'review':50B,72B 'run':64B 'runtim':22B 'screen':51B 'script':61B 'self':24B 'self-host':23B 'spam':30B,31B,49B 'spam-review':48B 'suppli':43B 'unauthent':56B 'valu':44B 'visitor':57B 'without':52B 'wordpress':26B,35B","search_c":"'6.91':86C 'administr':100C,120C 'allow':105C 'anti':77C 'anti-spam':76C 'arbitrari':110C 'browser':117C 'cleantalk':82C 'comment':92C,124C 'commenter-suppli':91C 'escap':89C 'execut':114C 'firewal':80C 'flag':123C 'inject':109C 'output':96C 'plugin':84C 'review':103C,122C 'screen':104C 'script':112C 'spam':78C,79C,102C 'spam-review':101C 'suppli':93C 'unauthent':106C 'user':107C 'valu':94C 'web':111C 'wordpress':83C","first_public_at":"2026-11-06T06:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115673","severity":null,"published_at":"2026-11-06T06:16:40+00:00","modified_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}