CVE-2026-65437

HighCVSS 7.1

Published: 27/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 28/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

XSS vulnerability in Spam protection, AntiSpam, FireWall by CleanTalk up to version 6.82. An unauthenticated attacker can inject malicious JavaScript.

Risk Assessment

Risk includes session theft, redirection to malicious sites, or theft of sensitive data.

Recommendation

Update the CleanTalk plugin to the latest version.

Other vulnerabilities in CleanTalk

CVE-2026-19855Medium
The CleanTalk WordPress plugin before version 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS