# CleanTalk vulnerabilities Source: https://junglewise.ai/threats/vendors/cleantalk Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/cleantalk.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in CleanTalk: 1 in the last 7 days and 9 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115673, was published on 6 November 2026. 4 vulnerabilities in the last four weeks, up 100% on the four before (2). ## Counts - Last 7 days: 1 - Last 30 days: 4 - Last 90 days: 9 - All time: 11 (1 critical, 0 exploited in the wild) ## About CleanTalk CleanTalk provides cloud-based anti-spam and security services for websites and CMS platforms. ## Latest CleanTalk vulnerabilities - [CVE-2026-115673: CleanTalk Anti-Spam stored XSS in comment author email](https://junglewise.ai/threats/cve-2026-115673-the-anti-spam-spam-firewall-by-cleantalk-wordpress-plugin-before) (info, published 6 Nov 2026) - [CVE-2026-114444: Security by CleanTalk WordPress plugin sensitive data disclosure via File System Watcher](https://junglewise.ai/threats/cve-2026-114444-the-security-plugin-firewall-malware-scanner-with-auto-removal) (info, published 30 Oct 2026) - [CVE-2026-114443: Security by CleanTalk authentication bypass via authenticator code](https://junglewise.ai/threats/cve-2026-114443-the-security-plugin-firewall-malware-scanner-with-auto-removal) (info, published 30 Oct 2026) - [CVE-2026-109198: CleanTalk Anti-Spam stored cross-site scripting in user email](https://junglewise.ai/threats/cve-2026-109198-the-anti-spam-by-cleantalk-spam-protection-without-captcha) (high, CVSS 7.2, published 23 Oct 2026) - [CVE-2026-103424: CleanTalk Anti-Spam plugin for WordPress stored XSS](https://junglewise.ai/threats/cve-2026-103424-the-anti-spam-by-cleantalk-spam-protection-without-captcha) (medium, CVSS 5.4, published 10 Oct 2026) - [CVE-2026-39768: CleanTalk Security & Malware scan unauthenticated XSS](https://junglewise.ai/threats/cve-2026-39768-unauthenticated-cross-site-scripting-xss-in-security-malware-scan) (high, CVSS 7.1, published 6 Oct 2026) - [CVE-2026-19855: CleanTalk WordPress plugin arbitrary shortcode execution in comments](https://junglewise.ai/threats/cve-2026-19855-cleantalk-wordpress-plugin-arbitrary-shortcode-execution-in) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-77830: CleanTalk Spam Protection stored XSS in comment content](https://junglewise.ai/threats/cve-2026-77830-cleantalk-spam-protection-stored-xss-in-comment-content) (high, CVSS 7.2, published 5 Sep 2026) - [CVE-2026-66593: CleanTalk Security & Malware Scan SQL injection](https://junglewise.ai/threats/cve-2026-66593-cleantalk-security-malware-scan-sql-injection) (critical, CVSS 9.3, published 20 Aug 2026) - [CVE-2026-10770: Drupal Anti-Spam by CleanTalk reflected XSS in API response handling](https://junglewise.ai/threats/cve-2026-10770-drupal-anti-spam-by-cleantalk-reflected-xss-in-api-response) (info, CVSS 4.2, published 10 Jul 2026) - [CVE-2026-8071: CleanTalk Anti-Spam stored XSS in email-encoding shortcode](https://junglewise.ai/threats/cve-2026-8071-cleantalk-anti-spam-stored-xss-in-email-encoding-shortcode) (info, CVSS 8.8, published 10 Jun 2026) ## Most severe CleanTalk vulnerabilities - [CVE-2026-66593: CleanTalk Security & Malware Scan SQL injection](https://junglewise.ai/threats/cve-2026-66593-cleantalk-security-malware-scan-sql-injection) (critical, CVSS 9.3, published 20 Aug 2026) - [CVE-2026-77830: CleanTalk Spam Protection stored XSS in comment content](https://junglewise.ai/threats/cve-2026-77830-cleantalk-spam-protection-stored-xss-in-comment-content) (high, CVSS 7.2, published 5 Sep 2026) - [CVE-2026-109198: CleanTalk Anti-Spam stored cross-site scripting in user email](https://junglewise.ai/threats/cve-2026-109198-the-anti-spam-by-cleantalk-spam-protection-without-captcha) (high, CVSS 7.2, published 23 Oct 2026) - [CVE-2026-39768: CleanTalk Security & Malware scan unauthenticated XSS](https://junglewise.ai/threats/cve-2026-39768-unauthenticated-cross-site-scripting-xss-in-security-malware-scan) (high, CVSS 7.1, published 6 Oct 2026) - [CVE-2026-19855: CleanTalk WordPress plugin arbitrary shortcode execution in comments](https://junglewise.ai/threats/cve-2026-19855-cleantalk-wordpress-plugin-arbitrary-shortcode-execution-in) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-103424: CleanTalk Anti-Spam plugin for WordPress stored XSS](https://junglewise.ai/threats/cve-2026-103424-the-anti-spam-by-cleantalk-spam-protection-without-captcha) (medium, CVSS 5.4, published 10 Oct 2026) - [CVE-2026-8071: CleanTalk Anti-Spam stored XSS in email-encoding shortcode](https://junglewise.ai/threats/cve-2026-8071-cleantalk-anti-spam-stored-xss-in-email-encoding-shortcode) (info, CVSS 8.8, published 10 Jun 2026) - [CVE-2026-10770: Drupal Anti-Spam by CleanTalk reflected XSS in API response handling](https://junglewise.ai/threats/cve-2026-10770-drupal-anti-spam-by-cleantalk-reflected-xss-in-api-response) (info, CVSS 4.2, published 10 Jul 2026) - [CVE-2026-115673: CleanTalk Anti-Spam stored XSS in comment author email](https://junglewise.ai/threats/cve-2026-115673-the-anti-spam-spam-firewall-by-cleantalk-wordpress-plugin-before) (info, published 6 Nov 2026) - [CVE-2026-114444: Security by CleanTalk WordPress plugin sensitive data disclosure via File System Watcher](https://junglewise.ai/threats/cve-2026-114444-the-security-plugin-firewall-malware-scanner-with-auto-removal) (info, published 30 Oct 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up 100% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "CleanTalk vulnerabilities", https://junglewise.ai/threats/vendors/cleantalk, 10 November 2026.