Executive brief
CleanTalk Spam Protection is a WordPress plugin that filters spam and malicious comments on websites. Due to insufficient input sanitization, an attacker can inject malicious JavaScript code into comment content that will execute in the browsers of visitors viewing the page. This vulnerability affects site reputation and could lead to credential theft, malware distribution, or defacement.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the CleanTalk plugin affecting versions up to 6.86. The vulnerability exists in the handling of comment content, specifically in the aria-label placeholder field, where user input is not properly sanitized before being stored and later output on the page without adequate escaping. Unauthenticated users can inject malicious scripts via comment submission; if comment moderation is enabled, the payload executes once a moderator approves the comment. Logged-in administrators are not affected by the injected script, but non-logged-in visitors will execute the payload when viewing the compromised page.
Affected products
- CleanTalk Spam Protection, Honeypot, Anti-Spam up to and including 6.86
Timeline
- 2026-09-05: disclosed
- other: CVE-2026-77830 assigned