Is CVE-2026-77830 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77830 being exploited in the wild.

How severe is CVE-2026-77830?

High severity, with a CVSS score of 7.2, published 5 September 2026.

Which products and versions are affected?

CleanTalk Spam Protection, Honeypot, Anti-Spam up to and including 6.86.

Is there a fix for CVE-2026-77830?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77830 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-77830?

Check whether you run CleanTalk Spam Protection, Honeypot or Anti-Spam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77830: CleanTalk Spam Protection stored XSS in comment content

CVE-2026-77830 · Severity: high · CVSS 7.2 · Published 2026-09-05

CleanTalk Spam Protection is a WordPress plugin that filters spam and malicious comments on websites. Due to insufficient input sanitization, an attacker can inject malicious JavaScript code into comment content that will execute in the browsers of visitors viewing the page. This vulnerability affects site reputation and could lead to credential theft, malware distribution, or defacement.

Vendors: CleanTalk.

Quick answers

Is CVE-2026-77830 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77830 being exploited in the wild.
How severe is CVE-2026-77830?: High severity, with a CVSS score of 7.2, published 5 September 2026.
Which products and versions are affected?: CleanTalk Spam Protection, Honeypot, Anti-Spam up to and including 6.86.
Is there a fix for CVE-2026-77830?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77830 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-77830?: Check whether you run CleanTalk Spam Protection, Honeypot or Anti-Spam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (XSS) vulnerability in the CleanTalk plugin affecting versions up to 6.86. The vulnerability exists in the handling of comment content, specifically in the aria-label placeholder field, where user input is not properly sanitized before being stored and later output on the page without adequate escaping. Unauthenticated users can inject malicious scripts via comment submission; if comment moderation is enabled, the payload executes once a moderator approves the comment. Logged-in administrators are not affected by the injected script, but non-logged-in visitors will execute the payload when viewing the compromised page.

Affected products

CleanTalk Spam Protection, Honeypot, Anti-Spam up to and including 6.86

Timeline

2026-09-05: disclosed
other: CVE-2026-77830 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.