Spam Protection, Honeypot, Anti-Spam by CleanTalk (<= 6.86) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/spam-protection-honeypot-anti-spam-by-cleantalk--6.86/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 05 Sep 2026 07:30:46 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS in CleanTalk WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-09-cleantalk-xss/Sat, 05 Sep 2026 07:30:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cleantalk-xss/The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to stored cross-site scripting via insufficient input sanitization in the comment content aria-label placeholder, allowing attackers to execute arbitrary scripts in the browsers of site visitors.The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 6.86. The vulnerability stems from insufficient sanitization of input data when processing the comment content aria-label placeholder. Authenticated attackers with custom-level access or higher can inject arbitrary JavaScript payloads through comment submissions. If comment moderation is enabled on the WordPress installation, the payload remains dormant until a site administrator approves the comment. Once published, the malicious script executes within the browser context of any non-logged-in visitor who views the page containing the comment. This vulnerability represents a significant risk for site integrity, potentially allowing for session hijacking, malicious redirects, or unauthorized actions performed on behalf of the victim.

Impact

Successful exploitation results in arbitrary code execution within the context of site visitors' browsers. This can lead to the theft of session cookies, redirection to malicious phishing sites, or unauthorized modifications to the page content viewed by the end-user. The target audience for the malicious script is primarily non-authenticated visitors, though the scope of impact depends on the traffic volume and the visibility of the compromised comment section on the affected WordPress site.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

  • Update the "Spam protection, Honeypot, Anti-Spam by CleanTalk" plugin to version 6.87 or the latest available release to resolve the sanitization flaw identified in CVE-2026-77830.
  • Review web access logs for suspicious HTTP POST requests directed at the WordPress comment submission endpoint (typically /wp-comments-post.php) that contain script tags or suspicious JavaScript event handlers in the comment metadata.
  • Enforce strict content security policies (CSP) on WordPress deployments to mitigate the execution of unauthorized inline scripts.
  • Audit user roles and permissions to ensure that only trusted users possess custom-level or higher access to the WordPress environment.
]]>highadvisoryxssweb-vulnerabilitywordpress