Description

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T06:16:40.373Z",
  "pubdate": "2026-11-06T06:16:40.373Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists in the Anti-Spam, Spam FireWall by CleanTalk WordPress plugin prior to version 6.91.\nThe vulnerability occurs due to improper input sanitization and output encoding of commenter-supplied data within the administrative dashboard.\nAn unauthenticated attacker can inject arbitrary malicious JavaScript into comment fields, which is subsequently executed within the context of an administrator's browser session when they view the spam-review interface.\nThe risk implication is significant, as successful exploitation enables attackers to hijack administrative sessions, perform unauthorized administrative actions, redirect users, or exfiltrate sensitive data, including session cookies and site configuration settings.\nThis vulnerability requires no authentication for the initial injection, relying instead on the interaction of a privileged user (administrator) viewing the malicious entry through the affected plugin component.\nAdministrators are advised to update to version 6.91 or later immediately to mitigate this security risk.",
  "technicalDetails": "The vulnerability is a classic Stored Cross-Site Scripting (XSS) flaw localized to the administrative interface of the Anti-Spam, Spam FireWall by CleanTalk plugin. The root cause is the failure of the plugin to implement adequate output encoding or context-aware sanitization for data originating from commenter input when rendering that data on the WordPress dashboard's spam-review screen.\nThe attack flow initiates when an unauthenticated attacker submits a comment containing a malicious payload (e.g., <script>alert(document.cookie)</script>) through the standard WordPress comment submission form. Because the plugin processes and stores this data to facilitate spam filtering and logging, the payload is persisted within the site's database.\nThe vulnerability is triggered when an administrator navigates to the plugin's administrative spam-review panel. When the plugin renders the list of flagged comments, it directly outputs the attacker-supplied string into the DOM of the administrative page without applying necessary escaping functions (such as esc_html() or esc_js()). Consequently, the browser interprets the injected payload as legitimate script content.\nExecution of the payload occurs within the security context of the administrator’s authenticated session. This grants the injected script full access to the Document Object Model (DOM) of the page, allowing the attacker to perform actions on behalf of the administrator. Potential post-exploitation impacts include the creation of unauthorized administrative accounts, modification of site settings, or the exfiltration of sensitive information, such as session tokens that could facilitate full account takeover.\nThe vulnerability is present in all versions of the Anti-Spam, Spam FireWall by CleanTalk plugin prior to 6.91. Since the payload is stored server-side, this vulnerability poses a persistent threat; the script remains active until the malicious entry is removed from the database or the vulnerable code path is patched. This vulnerability represents a failure in handling untrusted user input within the plugin's administrative output display logic, demonstrating a lack of adherence to secure WordPress development standards regarding output sanitization."
}