Anti-Spam by CleanTalk vulnerabilities

The Anti-Spam by CleanTalk plugin for WordPress up to version 6.88 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is exploitable once a comment from the attacker's email is approved; on default WordPress installations, only the first comment from a given email is moderated, and subsequent comments auto-approve.

The Anti-Spam by CleanTalk plugin for Drupal contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from 0.0.0 to 9.7.1.

Vulnerability in the Anti-Spam by CleanTalk WordPress plugin before version 6.79: improper content sanitization in a custom shortcode used in email encoding. Unauthenticated attackers can inject arbitrary web scripts into approved comments.