Description

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is deliverable via unauthenticated comment submission and executes exclusively for non-logged-in visitors; if comment moderation is enabled, an approving moderator must first publish the comment before the script reaches other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T07:17:12.163Z",
  "pubdate": "2026-09-05T07:17:12.163Z",
  "executiveSummary": "The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 6.86. This security flaw originates from insufficient input sanitization and improper output escaping concerning the aria-label attribute within comment content placeholders.\nThe vulnerability allows an attacker to inject arbitrary client-side scripts into web pages rendered to site visitors. While the injection is deliverable via unauthenticated comment submissions, the execution environment is restricted to non-authenticated visitors. If the target WordPress installation utilizes comment moderation, successful exploitation necessitates that an administrative user or moderator approves the malicious comment, thereby promoting the payload to a public state.\nThis vulnerability poses a significant risk to site integrity and visitor security. An attacker capable of executing arbitrary JavaScript can perform session hijacking, redirect users to malicious domains, or manipulate the Document Object Model (DOM) to facilitate phishing or credential harvesting. Given the broad nature of stored XSS, the impact is primarily focused on the compromise of end-user sessions rather than immediate server-side code execution.",
  "technicalDetails": "The root cause of this vulnerability is the inadequate sanitization of user-supplied input when processing comment content, specifically within the logic handling the aria-label attribute of placeholders. By failing to strip or encode malicious HTML tags and event handlers before rendering the data to the browser, the application allows for the persistence of arbitrary JavaScript payloads in the database.\nThe exploitation flow begins when an attacker submits a comment containing a crafted payload designed to break out of the aria-label attribute context. Because the input is processed without rigorous validation, the payload is stored directly in the WordPress database. When a non-authenticated visitor subsequently navigates to a page containing the injected comment, the WordPress environment renders the malicious payload within the HTML context of the comment section.\nBecause the payload is embedded within an aria-label attribute, the browser's HTML parser interprets the injected sequence as part of the element's property. If the attacker effectively breaks out of the attribute scope, they can inject event handlers—such as 'onmouseover' or other script-execution triggers—that force the execution of arbitrary JavaScript. This execution occurs exclusively within the browser context of the victim who is viewing the comment.\nThe attack vector is characterized by its reach: while the injection is triggered via public comment forms, the payload remains latent until the comment is published. If the site is configured to require moderation, the exploitation is dependent on the intervention of a moderator who unwittingly approves the submission. Once published, the script executes automatically for any unauthenticated visitor accessing the page, requiring no user interaction beyond visiting the compromised URL.\nFrom a post-exploitation perspective, the impact is constrained by the execution context of the victim. Since the script executes for non-logged-in visitors, the attacker cannot steal administrator session cookies directly. However, the attacker can leverage the victim's browser to perform unauthorized actions on the site, facilitate drive-by downloads, or use the site as a platform for further social engineering campaigns. The vulnerability highlights a breakdown in the output encoding pipeline, where user-controlled strings are reflected back into the document without context-aware sanitization."
}