Quick answers
- Is CVE-2026-8071 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8071 being exploited in the wild.
- How severe is CVE-2026-8071?
- Informational severity, with a CVSS score of 8.8, published 10 June 2026.
- Which products and versions are affected?
- CleanTalk Anti-Spam by CleanTalk < 6.79.
- Is there a fix for CVE-2026-8071?
- A patch was published on 2026-06-10: Fixed in version 6.79 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-8071 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-8071?
- Check whether you run CleanTalk Anti-Spam by CleanTalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the Anti-Spam by CleanTalk plugin due to insufficient sanitization of content within the [apbct_encode_data] custom shortcode. This shortcode is part of the plugin's email-encoding feature, which is active when a valid CleanTalk access key is configured. An unauthenticated attacker can craft a comment containing a broken shortcode structure to inject arbitrary HTML attributes and JavaScript events (e.g., oncontentvisibilityautostatechange). When the comment is rendered on the front-end, the malicious script executes in the context of the viewing user's session. This can lead to session hijacking or administrative actions if triggered by a logged-in admin. The issue is fixed in version 6.79.
Affected products
- CleanTalk Anti-Spam by CleanTalk < 6.79
Timeline
- 2026-05-20: disclosed: Public disclosure by researcher
- 2026-06-10: advisory: NVD publication date
- 2026-06-10: patched: Fixed in version 6.79