CVE-2026-19855

MediumCVSS 6.5

Published: 09/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The CleanTalk WordPress plugin before version 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

Risk Assessment

An attacker can execute arbitrary shortcodes, potentially leading to site takeover, data theft, or malware distribution. It may also compromise content integrity and user trust.

Recommendation

Update the CleanTalk plugin to version 6.87 or later. Also check other plugins for similar shortcode injection vulnerabilities.

Other vulnerabilities in CleanTalk

CVE-2026-65437High
XSS vulnerability in Spam protection, AntiSpam, FireWall by CleanTalk up to version 6.82. An unauthenticated attacker can inject malicious JavaScript.

Original NVD description (English source)

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS