CVE-2026-103424 in Anti-Spam by CleanTalk Plugin
Summary
by MITRE • 10/10/2026
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable once a comment from the attacker's email address has been approved; on default WordPress installations, only the first comment from a given email address is held for moderation, meaning subsequent comments auto-approve and immediately expose the payload to site visitors.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The Anti-Spam by CleanTalk plugin for WordPress contains a critical stored cross-site scripting vulnerability affecting all versions up to and including 6.88. This security flaw stems from insufficient input sanitization and output escaping mechanisms within the application code, specifically targeting the comment parameter used during user interactions on affected websites. The absence of robust validation allows malicious actors to inject arbitrary web scripts into the database rather than merely displaying them transiently in a request payload. Because the data is stored server-side before being served to other users, the impact extends far beyond the initial submission point, creating a persistent threat vector that compromises the integrity and security posture of the entire WordPress installation hosting this plugin.
The operational mechanics of this vulnerability rely on the specific moderation settings inherent to default WordPress configurations. When an unauthenticated attacker submits a comment containing malicious JavaScript via their email address, the system initially holds it for moderation if no prior comments exist from that address. However, once that first comment is approved by an administrator or automatically passes through basic filters, subsequent submissions from the same email address are auto-approved without further review. This behavior means that after the initial approval step, any additional crafted payloads will be immediately published and exposed to all site visitors who load the affected page. The stored nature of this cross-site scripting attack ensures that every user viewing the compromised content triggers the execution of the injected scripts in their browser environment.
The impact of exploiting this vulnerability is severe, as it enables unauthenticated attackers to execute arbitrary client-side code within the context of the victim site. This can lead to session hijacking through cookie theft, allowing attackers to impersonate legitimate users and gain unauthorized access to administrative accounts or sensitive user data. Furthermore, the attacker can perform actions on behalf of victims, such as modifying content, changing settings, or redirecting traffic to malicious sites designed for phishing or malware distribution. The persistence of the payload ensures that the attack is not limited to a single interaction but continues to affect multiple users over time until the vulnerable code is removed from the database and the plugin is updated or disabled.
From an industry standards perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific technique employed here falls under the category of Stored XSS, where malicious scripts are permanently stored on target servers and delivered to victims when they request legitimate content. In terms of tactical classification within the MITRE ATT&CK framework for enterprise security, this activity corresponds to T1059 Command and Control scripting using JavaScript or potentially T1189 Drive-by Compromise if the payload is designed to exploit browser vulnerabilities upon execution. The attack vector leverages social engineering elements by disguising malicious code as legitimate user-generated content, thereby bypassing many perimeter defenses that do not inspect stored data for script injection patterns.
Mitigation strategies must prioritize immediate remediation of the affected software version. Administrators should update the Anti-Spam by CleanTalk plugin to a patched version released after 6.88 where input sanitization and output escaping have been rigorously implemented. If an immediate update is not feasible, disabling the comment functionality or switching to alternative moderation plugins that enforce stricter validation rules can reduce exposure. Additionally, implementing Content Security Policy headers on the web server can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to execute. Regular security audits and code reviews focusing on user input handling are essential to prevent similar vulnerabilities in future updates or other plugins within the WordPress ecosystem.