CVE-2026-8071

Vulnerability

The Anti-Spam by CleanTalk WordPress plugin versions prior to 6.79 contain a vulnerability where user-supplied content within a custom shortcode used for email encoding is not properly sanitized. This allows for the injection of arbitrary web scripts into approved comments [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by injecting malicious scripts into a comment that uses the affected shortcode. These scripts will execute when any user, including administrators, views the post containing the comment [1].

Impact

Successful exploitation allows an attacker to inject arbitrary web scripts into approved comments. These scripts execute in the context of the user viewing the comment, potentially leading to session hijacking, defacement, or other client-side attacks with the privileges of the viewing user [1].

Mitigation

The vulnerability is fixed in version 6.79 of the Anti-Spam by CleanTalk WordPress plugin. Users are advised to update to version 6.79 or later to mitigate this risk [1].