WordPress Plugin Vulnerabilities

Spam protection, AntiSpam, FireWall by CleanTalk < 6.83 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some data before outputting it back in a page, leading to a Stored Cross-Site Scripting vulnerability which can be exploited by unauthenticated attackers to inject arbitrary web scripts that will execute when a user views the affected page.

Affects Plugins

Plugin icon
cleantalk-spam-protect
Fixed in 6.83

References

CVE
CVE-2026-65437
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/222079a2-20f1-4d53-8420-46ccc50988a8

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
fde77dbd-d6d7-4509-909b-04832dd33088

Timeline

Publicly Published
2026-07-27 (about 28 days ago)
Added
2026-07-30 (about 25 days ago)
Last Updated
2026-07-30 (about 25 days ago)

Other

Published
Title
Published
2024-12-13
Title
Connatix Video Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-03-18
Title
Better Search < 3.3.1 - Unauthenticated Stored Cross-Site Scripting
Published
2022-02-21
Title
Team Circle Image Slider With Lightbox < 1.0.16 - Reflected Cross-Site Scripting
Published
2015-02-22
Title
Image Metadata Cruncher - Multiple Cross-Site Scripting (XSS)
Published
2014-08-01
Title
GRAND Flash Album Gallery < 1.67 - Reflected Cross-Site Scripting