# CVE-2026-8071: CleanTalk Anti-Spam stored XSS in email-encoding shortcode

Source: https://junglewise.ai/threats/cve-2026-8071-cleantalk-anti-spam-stored-xss-in-email-encoding-shortcode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-8071 · Severity: info · CVSS 8.8 · Published 2026-06-10

A popular WordPress anti-spam plugin contains a security flaw that allows attackers to bypass spam filters and inject malicious scripts into website comments. If an administrator or visitor views a page containing one of these malicious comments, the script could execute in their browser, potentially leading to unauthorized actions or account takeover. This risk is particularly high for sites that use the plugin's email-encoding feature to protect contact information.

Vendors: [CleanTalk](https://junglewise.ai/threats/vendors/cleantalk).

## Quick answers

**Is CVE-2026-8071 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8071 being exploited in the wild.

**How severe is CVE-2026-8071?** Informational severity, with a CVSS score of 8.8, published 10 June 2026.

**Which products and versions are affected?** CleanTalk Anti-Spam by CleanTalk < 6.79.

**Is there a fix for CVE-2026-8071?** A patch was published on 2026-06-10: Fixed in version 6.79 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8071 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8071?** Check whether you run CleanTalk Anti-Spam by CleanTalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the Anti-Spam by CleanTalk plugin due to insufficient sanitization of content within the [apbct_encode_data] custom shortcode. This shortcode is part of the plugin's email-encoding feature, which is active when a valid CleanTalk access key is configured. An unauthenticated attacker can craft a comment containing a broken shortcode structure to inject arbitrary HTML attributes and JavaScript events (e.g., oncontentvisibilityautostatechange). When the comment is rendered on the front-end, the malicious script executes in the context of the viewing user's session. This can lead to session hijacking or administrative actions if triggered by a logged-in admin. The issue is fixed in version 6.79.

## Affected products

- CleanTalk Anti-Spam by CleanTalk < 6.79

## Timeline

- 2026-05-20: disclosed: Public disclosure by researcher
- 2026-06-10: advisory: NVD publication date
- 2026-06-10: patched: Fixed in version 6.79

## References

- [https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/](https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/)

## Related threats

- [Drupal Anti-Spam by CleanTalk reflected XSS in API response handling](https://junglewise.ai/threats/cve-2026-10770-drupal-anti-spam-by-cleantalk-reflected-xss-in-api-response)