CVE-2026-8071: Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass

Synopsis

This is a stored cross-site scripting (XSS) vulnerability in the Anti-Spam by CleanTalk. Spam protection WordPress plugin before version 6.79. An unauthenticated attacker can inject malicious JavaScript into approved comments by abusing a sanitization gap in the plugin's email-encoding shortcode; the script executes in the browser of any user who views the affected post, including site administrators. Successful exploitation gives the attacker the ability to read session tokens, perform actions on behalf of the victim, and fully compromise site integrity when an administrator triggers the payload. A patched-image rebuild at version 6.79 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker submits a crafted comment over the network to any publicly reachable WordPress installation running the vulnerable plugin, with no need for local or physical access.

• AuthenticationNot required

  No account or credentials are needed; the comment submission endpoint is open to anonymous users by default.

• Victim interactionRequired

  A user (such as a site administrator) must view the post containing the injected comment in their browser for the malicious script to execute.

• Attack complexityDetail

  Exploitation is reliable and condition-free; once the comment is approved, the payload fires for every subsequent page view with no race condition or special environmental setup required.

Blast Radius

• Reads session cookies and authentication tokens from the victim's browser, enabling account takeover.
• Performs arbitrary administrative actions in the WordPress dashboard on behalf of an administrator who views the post.
• Modifies site content, injects persistent backdoors, or creates rogue admin accounts using the hijacked session.
• Exfiltrates data visible to the victim, including customer records or other sensitive content rendered on the page.