CVE-2026-115673— Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

Quick assessment

Affected

Unknown Anti-Spam, Spam FireWall by CleanTalk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CleanTalk 的 WordPress 插件"Anti-Spam, Spam FireWall"在版本 6.91 之前存在安全漏洞：该插件在将评论者提供的值输出到管理员垃圾评论审查页面时，未对其进行转义处理。这导致未认证用户可以注入任意 Web 脚本，当管理员查看被标记的评论时，这些脚本将在其浏览器中执行。

AI Predicted 6.1 Difficulty: Easy Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Updated Nov 06, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

Source: CVE Program / CVE List V5

Vulnerability Description

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Anti-Spam, Spam FireWall by CleanTalk	0 ~ 6.91	-

II. Public POCs for CVE-2026-115673

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115673

请登录查看更多情报信息。

Other References for CVE-2026-115673 (1)

https://wpscan.com/vulnerability/087d91ac-2158-4f9b-8fab-4d17b14a7053/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-115673

Same Patch Batch · Unknown · 2026-11-06 · 30 CVEs total

CVE-2026-118423	10.0 CRITICAL	WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
CVE-2026-88800	9.1 CRITICAL	MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Rol
CVE-2026-88799	8.8 HIGH	MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover
CVE-2026-88801	8.0 HIGH	MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Ro
CVE-2026-121633	5.3 MEDIUM	Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Liste
CVE-2026-121636	5.3 MEDIUM	Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the
CVE-2026-118166	4.8 MEDIUM	MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution vi
CVE-2026-113615		GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
CVE-2026-118239		AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth
CVE-2026-118188		PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure
CVE-2026-118167		MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override
CVE-2026-118187		PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR
CVE-2026-118186		PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revi
CVE-2026-86606		iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
CVE-2026-110813		Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Nam
CVE-2026-110525		MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent
CVE-2026-92396		Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css
CVE-2026-12967		WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass
CVE-2026-87784		Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission
CVE-2026-119259		All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write

Showing top 20 of 30 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Unknown