CVE-2026-109198

Name of the Vulnerable Software and Affected Versions Anti-Spam by CleanTalk versions prior to 6.89.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the user email parameter. Exploitation requires user registration to be enabled on the site. The injected script executes when an Administrator performs a user-spam scan and views the Non-checkable users or Spam users tab.

Recommendations Update to a version newer than 6.89.1. Restrict user registration on the site to minimize the risk of exploitation.