CVE-2026-19855

Deferred Deferred - Pending Action

Unauthenticated Shortcode Execution in CleanTalk WordPress Plugin

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: WPScan

Description

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-19855

EUVD

EUVD-2026-74721

Affected Vendors & Products

Vendor	Product	Version / Range
cleantalk	cleantalk_wordpress_plugin	to 6.87 (exc)
cleantalk	spam_protection_honeypot_anti_spam	to 6.87 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

The CleanTalk WordPress plugin before version 6.87 allows unauthenticated users to inject arbitrary shortcodes into comment text. These shortcodes are then executed server-side and rendered for all visitors of the page, enabling potential code execution and content manipulation.

Detection Guidance

Check the installed version of the CleanTalk WordPress plugin. If it is below 6.87, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

An attacker could exploit this to execute malicious code on your server, inject unauthorized content, or perform actions as if they were an admin. All visitors to affected pages would see the manipulated content, potentially leading to data theft or defacement.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations may face compliance breaches if sensitive data is exposed or altered due to the flaw.

Mitigation Strategies

Update the CleanTalk plugin to version 6.87 or later immediately. Disable the plugin temporarily if an update is not immediately available. Review server logs for suspicious shortcode execution attempts.

Hi! I’m here to help you understand CVE-2026-19855. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70