CVE-2026-8071
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in the Anti-Spam by CleanTalk WordPress plugin before version 6.79: improper content sanitization in a custom shortcode used in email encoding. Unauthenticated attackers can inject arbitrary web scripts into approved comments.
Risk Assessment
Scripts execute when any user (including administrators) views the post, potentially leading to session theft or defacement.
Recommendation
Update the Anti-Spam by CleanTalk plugin to version 6.79 or later.
Other vulnerabilities in Anti-Spam by CleanTalk
Original NVD description (English source)
The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.