CVE-2026-8071

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

Score

CVSS 3.1 8.8 High

Status

Deferred - contact@wpscan.com

Published

2026-06-10

Last modified

2026-06-10

Weaknesses

CWE-79

Affected products

• Anti-spam By Cleantalk. Spam Protection (Unknown)

References

• https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/