{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/anti-spam-by-cleantalk--spam-protection-without-captcha--6.89.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cleantalk:anti-spam_by_cleantalk:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109198"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA (\u003c= 6.89.1)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss","wordpress","plugin-vulnerability"],"_cs_type":"advisory","_cs_vendors":["CleanTalk"],"content_html":"\u003cp\u003eThe Anti-Spam by CleanTalk - Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'user_email' parameter in versions 6.89.1 and earlier. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject malicious scripts during the registration process. The script executes when an administrator views the plugin's 'Non-checkable users' or 'Spam users' tab.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress site with the vulnerable CleanTalk plugin installed and user registration enabled.\u003c/li\u003e\n\u003cli\u003eAttacker submits a registration request using a malicious payload in the 'user_email' field.\u003c/li\u003e\n\u003cli\u003eThe plugin fails to sanitize the malicious input and stores it in the WordPress database.\u003c/li\u003e\n\u003cli\u003eThe plugin flags the registration as spam or 'non-checkable' based on its internal logic.\u003c/li\u003e\n\u003cli\u003eAn administrator navigates to the plugin's dashboard to review the spam reports.\u003c/li\u003e\n\u003cli\u003eThe plugin displays the list of spam users, causing the stored XSS payload to execute within the administrator's browser session.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the context of an administrator's browser session. This can lead to unauthorized actions performed on behalf of the administrator, such as creating new administrative accounts, modifying plugin settings, or redirecting site traffic.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the \u0026quot;Anti-Spam by CleanTalk - Spam Protection Without CAPTCHA\u0026quot; plugin to the latest version available beyond 6.89.1. Ensure user registration settings are restricted to known users until a patch is applied if the plugin cannot be updated immediately.\u003c/p\u003e\n","date_modified":"2026-10-23T06:47:11Z","date_published":"2026-10-23T06:47:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cleantalk-xss/","summary":"The Anti-Spam by CleanTalk plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session via the 'user_email' parameter.","title":"Anti-Spam by CleanTalk: Stored Cross-Site Scripting (CVE-2026-109198)","url":"https://feed.craftedsignal.io/briefs/2026-10-cleantalk-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA (\u003c= 6.89.1)","version":"https://jsonfeed.org/version/1.1"}