CVE-2026-77830
Received Received - Intake

Stored XSS in Spam Protection Honeypot Anti-Spam CleanTalk WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Wordfence

Description
The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is deliverable via unauthenticated comment submission and executes exclusively for non-logged-in visitors; if comment moderation is enabled, an approving moderator must first publish the comment before the script reaches other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-77830
EUVD
EUVD-2026-71878

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cleantalk spam_protection_honeypot_anti_spam to 6.86 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the CleanTalk anti-spam WordPress plugin. It allows authenticated attackers with custom-level access or higher to inject malicious scripts via comment content aria-label placeholders. The scripts execute when non-logged-in users view the page. The payload can be delivered through unauthenticated comment submissions.

Detection Guidance

To detect this vulnerability, inspect WordPress sites using the Spam protection, Honeypot, Anti-Spam by CleanTalk plugin versions up to 6.86. Check for unauthenticated comment submissions with suspicious scripts in the Comment Content aria-label placeholder. Review comments awaiting moderation for injected scripts.

Impact Analysis

An attacker could exploit this to steal user sessions, redirect users to malicious sites, or perform actions on their behalf. Non-logged-in visitors are most at risk as scripts execute for them. If comment moderation is enabled, a moderator must approve the comment first for the attack to succeed.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may risk protected health information exposure. Both standards require protecting against unauthorized script execution and data breaches.

Mitigation Strategies

Immediately update the CleanTalk plugin to the latest version beyond 6.86. Disable comment moderation temporarily if enabled. Review and remove any suspicious comments already published. Implement additional input sanitization for comment fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart