Read the docs
TI-2026-79549 Aliases CVE-2026-109198GHSA-qg8v-7rmw-27ch

Anti-Spam by CleanTalk: Unauthenticated Stored XSS via user_email

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting (CWE-79) via the 'user_email' parameter in all versions up to and including 6.89.1, due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that run whenever a user opens the injected page, provided user registration is open on the site. Execution happens when an Administrator runs the plugin's user-spam scan and views the Non-checkable users or Spam users tab, the plugin's documented workflow. CVSS 3.1 base score 7.2 (HIGH); not listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00378 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cleantalkCleanTalk Anti-Spam – Complete Spam Protectionup to 6.89.1—No fix listedCNA
  • CleanTalk Anti-Spam – Complete Spam Protection Vendorcleantalk Affected up to 6.89.1 Fixed in — No fix listed CNA

Remediation

No fixed version is listed in the advisory for CleanTalk Anti-Spam versions 6.89.1 and earlier. Until a patched release is available, disable user registration on the site or remove the plugin, and review existing user emails for injected script.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-109198
  2. 2026-10-23 Alias added: GHSA-qg8v-7rmw-27ch
  3. 2026-10-23 CISA SSVC decision points changed
  4. 2026-10-23 Priority changed: MEDIUM → LOW

References

Other 6

  • TI-2022-03051 Anti-Spam by CleanTalk < 5.185.1 - Admin+ SQLi CVSS 3.1HIGH 7.2
  • TI-2024-09765 Missing authorization in cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk CVSS 3.1CRITICAL 9.8
  • TI-2024-12407 Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2026-01186 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via… CVSS 3.1CRITICAL 9.8
  • TI-2026-47264 WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2024-09993 Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to… CVSS 3.1HIGH 8.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences