CVE-2026-8071

Description

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

PUBLISHED Reserved 2026-05-07 | Published 2026-06-10 | Updated 2026-06-10 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Credits

Matthew Rollings finder

WPScan coordinator

References

wpscan.com/...rability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/ exploit vdb-entry technical-description

cve.org (CVE-2026-8071)

nvd.nist.gov (CVE-2026-8071)

Download JSON