PT-2026-48387

CVE-2026-8071

Published

2026-06-10

Updated

2026-06-18

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anti-Spam by CleanTalk. Spam protection WordPress plugin versions prior to 6.79

Description Insufficient sanitization of content within a custom shortcode used in the email-encoding feature allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This enables the injection of arbitrary web scripts into approved comments, which are then executed when any user, including administrators, views the post.

Recommendations Update to version 6.79 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Matthew Rollings

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers