Anti-Spam by CleanTalk: Stored Cross-Site Scripting (CVE-2026-109198)

The Anti-Spam by CleanTalk - Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'user_email' parameter in versions 6.89.1 and earlier. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject malicious scripts during the registration process. The script executes when an administrator views the plugin's 'Non-checkable users' or 'Spam users' tab.

Attack Chain

1. Attacker identifies a WordPress site with the vulnerable CleanTalk plugin installed and user registration enabled.
2. Attacker submits a registration request using a malicious payload in the 'user_email' field.
3. The plugin fails to sanitize the malicious input and stores it in the WordPress database.
4. The plugin flags the registration as spam or 'non-checkable' based on its internal logic.
5. An administrator navigates to the plugin's dashboard to review the spam reports.
6. The plugin displays the list of spam users, causing the stored XSS payload to execute within the administrator's browser session.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of an administrator's browser session. This can lead to unauthorized actions performed on behalf of the administrator, such as creating new administrative accounts, modifying plugin settings, or redirecting site traffic.

Recommendation

Update the "Anti-Spam by CleanTalk - Spam Protection Without CAPTCHA" plugin to the latest version available beyond 6.89.1. Ensure user registration settings are restricted to known users until a patch is applied if the plugin cannot be updated immediately.