CVE-2026-115673 in Anti-Spam Spam FireWall Plugin
Summary
by MITRE • 11/06/2026
The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in versions of the CleanTalk Anti-Spam and Spam Firewall plugin prior to version 6.91 represents a critical security flaw within the WordPress ecosystem, specifically categorized as Cross-Site Scripting or reflected XSS. This issue stems from an insufficient input validation mechanism where user-supplied data is not properly sanitized before being rendered in a sensitive administrative interface. The CleanTalk plugin is widely deployed for managing comment spam and protecting websites from malicious submissions, making its security posture vital for the integrity of WordPress sites globally. When a commenter submits content that triggers the anti-spam filters, it is flagged for review by site administrators. In this specific scenario, the application fails to escape special characters within the submitted value when displaying it on the administrative spam-review screen. This lack of encoding allows an attacker to inject arbitrary web scripts into the page context.
From a technical perspective, the flaw operates as a reflected cross-site scripting vulnerability rather than stored XSS because the malicious payload is typically delivered via a crafted link or request that triggers the display logic without necessarily persisting in the database for long-term storage, although some implementations may store it temporarily during review. The core issue lies in the output encoding process on the server side. When the administrator accesses the spam queue to evaluate flagged comments, the application retrieves the comment data and renders it directly into the HTML response without applying appropriate context-aware escaping rules. This allows any JavaScript code embedded within the commenter-supplied value to execute immediately upon page load within the browser session of the authenticated administrator. The attacker does not need valid credentials for the WordPress site but must trick an admin into viewing a specific flagged comment containing the malicious payload, often through social engineering tactics such as phishing emails or compromised third-party sites that direct traffic to the vulnerable review screen.
The operational impact of this vulnerability is severe due to the privilege level of the target user. Since the script executes in the context of an administrator account, it grants the attacker full control over the WordPress dashboard and its associated functionalities. An adversary can exploit this execution environment to perform actions such as creating new administrative users with elevated privileges, modifying site settings, injecting malicious code into themes or plugins, exfiltrating sensitive data including database credentials from configuration files, or defacing the website. Furthermore, because the attack relies on the administrator's active session cookies, it facilitates session hijacking if combined with other techniques like stealing cookie values via JavaScript document.cookie access. This effectively compromises not only the WordPress installation but potentially any backend systems accessible through that administrative interface, leading to a complete site takeover and potential lateral movement within the organization's network infrastructure.
In terms of industry standards, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under sub-categories involving reflected XSS where user input is echoed back without sanitization. From a tactical perspective within the MITRE ATT&CK framework for enterprise security, this vulnerability supports techniques such as T1059 Command and Scripting Interpreter, allowing execution of arbitrary code in the victim's browser context. It also facilitates T1078 Valid Accounts by enabling attackers to escalate privileges or create persistent backdoor accounts through the compromised admin session. The attack vector is classified under Initial Access via Spearphishing Link if delivered externally, leveraging the trust relationship between the attacker and the site administrator who performs routine spam reviews.
Mitigation strategies must focus on immediate remediation of the software version alongside broader security hygiene practices. The primary defense is to upgrade the CleanTalk Anti-Spam and Spam Firewall plugin to version 6.91 or later, where this input validation flaw has been patched by implementing proper output encoding functions such as esc_html or wp_kses_post in PHP code before rendering user data. Administrators should also ensure that all WordPress core files and other plugins are updated to their latest stable releases to prevent compounding vulnerabilities. Implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious payloads containing script tags or event handlers before they reach the application logic. Additionally, enforcing strict Content Security Policy headers on the administrative pages can mitigate the impact of any successful XSS attempts by restricting the sources from which scripts are allowed to execute. Regular security audits and code reviews focusing on input/output handling in custom plugins will further reduce the risk surface for similar injection flaws in WordPress environments.