CVE-2026-8071: Anti-Spam by CleanTalk XSS Vulnerability – WordPress Plugin Patch Guide

Technical summary

CVE-2026-8071 is a stored cross-site scripting (XSS) vulnerability in the Anti-Spam by CleanTalk plugin affecting all versions prior to 6.79. The vulnerability stems from insufficient input sanitization within a custom shortcode used for email encoding. An unauthenticated attacker can inject arbitrary JavaScript into approved comments; when the post is viewed by any user, including administrators, the malicious script executes in their browser context. The CVSS 3.1 score of 8.8 (HIGH) reflects the network-based attack vector, lack of authentication requirement, user interaction dependency, and high impact across confidentiality, integrity, and availability.

Business impact

WordPress sites running the vulnerable plugin are at risk of account compromise, data theft, and malware distribution. Because the injected script executes for all viewers—including site administrators—attackers can potentially escalate privileges, modify site content, or harvest sensitive information. For e-commerce or multi-author sites, this could result in unauthorized transactions, data breaches, or loss of user trust. The reputational damage from a compromised WordPress installation can be significant, particularly if malware is injected into pages served to visitors.

Affected systems

Any WordPress installation with the Anti-Spam by CleanTalk plugin installed and active at version 6.78 or earlier is vulnerable. The plugin is widely used for spam protection across WordPress sites of varying sizes. Exposure depends on plugin adoption and whether administrators have kept the plugin updated.

Exploitability

Exploitability is straightforward: an attacker submits a comment containing malicious JavaScript wrapped in the vulnerable shortcode, and if the comment passes moderation (or if the site allows unapproved comments), the script will execute for all subsequent viewers. No special privileges or authentication are required to craft the attack, though successful exploitation typically depends on the comment being approved or visible. The reliance on user interaction (viewing the post) is a minor friction point but does not significantly reduce risk given that legitimate site traffic will naturally trigger the payload.

Remediation

Update the Anti-Spam by CleanTalk plugin to version 6.79 or later immediately. This patch properly sanitizes input within the email-encoding shortcode, preventing script injection. Site administrators should also review published posts and comments for any suspicious or injected content, particularly those containing shortcodes, and remove or sanitize them if found.

Patch guidance

Upgrade the Anti-Spam by CleanTalk plugin to version 6.79 or later via the WordPress plugin dashboard (Plugins → Updates) or manually through the WordPress plugin repository. If automatic updates are not enabled, prioritize this update immediately given the HIGH severity and ease of exploitation. After patching, conduct a brief audit of recent approved comments to identify any malicious payloads that may have been injected prior to the update.

Detection guidance

Monitor WordPress comment activity for unusual syntax or shortcode patterns, particularly those embedding email-encoding functions. Use WordPress security plugins (e.g., Wordfence, Sucuri) configured to detect XSS and script injection attempts in comments. Log review should focus on any approved comments submitted shortly before the vulnerability disclosure or during periods when the plugin was unpatched. Additionally, review browser console errors or unexpected JavaScript execution on posts with suspected injected comments.

Why prioritize this

This vulnerability scores HIGH (CVSS 8.8) due to network accessibility, absence of authentication barriers, high impact on confidentiality and integrity, and the ease with which malicious comments can be crafted and served to administrators and users. The stored nature of the XSS means the attack persists until manually remediated, and the lack of a KEV designation does not diminish urgency—patching should not be deferred.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-based attack vector requiring no physical access; (2) Low complexity—standard comment submission suffices; (3) No privilege or authentication required; (4) User interaction required (viewing the post), which slightly lowers the score but remains likely in normal site usage; (5) High impact to confidentiality (session hijacking, credential theft), integrity (content modification, malware injection), and availability (potential account lockout or site defacement). The score appropriately captures the risk of widespread compromise across a WordPress installation.

Frequently asked questions