CVE-2026-8071 - Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass · CoreCVE

Back Back to CVE browser

HIGH

Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass

Published Jun 10, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.51%

Description

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

Affected products

Vendor n/a Product Anti-Spam by CleanTalk. Spam protection Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <6.79

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Anti-Spam by CleanTalk. Spam protection

unaffected

Version	Status	Constraints
0	affected	<6.79

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jun 10, 2026

Updated Jun 10, 2026

Reserved May 7, 2026

Link CVE-2026-8071

CISA Vulnrichment

Updated Jun 10, 2026

Status Deferred

Modified Jul 23, 2026

Link CVE-2026-8071

Severity n/a

Public date n/a

Links CVE-2026-8071