CVE-2026-65437 in Spam protection, AntiSpam, FireWall Plugin
Summary
by MITRE • 07/28/2026
Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability represents a critical unauthenticated cross site scripting flaw within the spam protection and firewall modules of CleanTalk plugins for WordPress systems. The issue affects versions up to and including 6.82, where malicious actors can inject arbitrary javascript code through the spam protection mechanisms without requiring any authentication credentials. The vulnerability stems from insufficient input validation and output sanitization within the anti-spam and firewall components that process user submissions and requests. This weakness allows attackers to execute malicious scripts in the context of victim browsers, potentially leading to session hijacking, data theft, or further exploitation of compromised systems.
The technical implementation of this vulnerability occurs when the plugin fails to properly sanitize user input received through various communication channels such as contact forms, comment sections, or API endpoints that are protected by CleanTalk's spam detection system. The anti-spam functionality processes incoming requests and may store or display user-provided content without adequate filtering mechanisms, creating an attack surface where malicious payloads can be injected and subsequently executed. This flaw operates at the application layer and specifically affects the plugin's ability to handle untrusted data inputs that flow through its spam protection and firewall modules.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with persistent access vectors within compromised WordPress environments. Once exploited, malicious scripts can harvest cookies, capture login credentials, redirect users to phishing sites, or even establish backdoors for continued unauthorized access. The unauthenticated nature of the exploit means that any user with access to the affected website can potentially trigger the vulnerability, making it particularly dangerous in multi-user environments where administrators may not always be aware of all active users or their activities. Additionally, the firewall protection mechanisms that should be safeguarding against such attacks become compromised, undermining the core security posture of the system.
Security professionals should implement immediate mitigations including updating to versions beyond 6.82 where patches have been released to address the XSS vulnerability. Network administrators should monitor for suspicious activity patterns and consider implementing additional security measures such as web application firewalls or content security policies to prevent exploitation attempts. The vulnerability aligns with CWE-79 which specifically addresses cross site scripting flaws in web applications, and follows ATT&CK technique T1566 related to spearphishing attacks that often leverage XSS vulnerabilities to establish initial access. Organizations should also conduct thorough security assessments of their WordPress installations to identify any other potentially vulnerable components and ensure comprehensive protection against similar attack vectors that could compromise their digital infrastructure.