CVE-2026-77830

Name of the Vulnerable Software and Affected Versions Spam protection, Honeypot, Anti-Spam by CleanTalk for WordPress versions prior to 6.87

Description Insufficient input sanitization and output escaping allow authenticated attackers with custom-level access and above to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the Comment Content aria-label placeholder. While the payload can be delivered through unauthenticated comment submissions, it executes only for non-logged-in visitors. If comment moderation is active, a moderator must publish the comment before the script is triggered for other users.

Recommendations Update the plugin to version 6.87 or later.