CVE-2026-103424

Name of the Vulnerable Software and Affected Versions Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA versions prior to 6.89

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the comment parameter. Attackers can inject arbitrary web scripts that execute when a user accesses the affected page. This is exploitable after a comment from the attacker's email is approved; since default WordPress installations typically only moderate the first comment from a specific email, subsequent comments may be auto-approved, immediately exposing the payload to visitors.

Recommendations Update Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA to version 6.89 or later. Avoid using the comment parameter for unverified user input until the update is applied.