PT-2026-48387 · Cleantalk · Anti-Spam

Matthew Rollings · CVE-2026-8071 · Published 2026-06-10 · Updated 2026-06-18

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anti-Spam by CleanTalk. Spam protection WordPress plugin versions prior to 6.79

Description Insufficient sanitization of content within a custom shortcode used in the email-encoding feature allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This enables the injection of arbitrary web scripts into approved comments, which are then executed when any user, including administrators, views the post.

Recommendations Update to version 6.79 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8071

Affected Products

Anti-Spam

References · 9

• 🔥 https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8071 · Security Note
• https://t.me/cveNotify/166796 · Telegram Post
• https://t.me/cveNotify/166812 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2064623129171792217 · Twitter Post
• https://t.me/CVEtracker/56425 · Telegram Post
• https://twitter.com/CVEnew/status/2064709848969695438 · Twitter Post
• https://twitter.com/infoflowcloud/status/2064710696441430058 · Twitter Post
• https://reddit.com/r/StopBadBots/comments/1u9g5re/your_security_plugins_might_be_the_weakest_link · Reddit Post