Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected v...

CVE-2024-10542

Poc Of CVE-2024-10542 and CVE-2024-10781 Broken Authentication in Spam protection, AntiSpam, FireWall by CleanTalk Plugin = 6.43.2 Disclaimer: The information provided in this document regarding for CVE-2024-10542 is for learning and educational purposes only. We do not encourage or authorize the...

WordPress Anti-Spam, Spam FireWall by CleanTalk plugin < 6.91 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk versions 6.91...

CVE-2026-115673 Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who review...

CVE-2026-115673

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin (versions before 6.91 ) is vulnerable to an unauthenticated stored XSS vulnerability. The root cause is the failure to escape commenter-supplied values (specifically the comment author email ) before they are rendered on the administrativ...

CVE-2026-114443 Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-114443

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin (versions before 2.191 ) contains an unauthenticated authentication bypass vulnerability. The root cause is that the plugin fails to verify the account password before accepting an authenticator-app two-factor code...

CVE-2026-114443 Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-114444 Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

WordPress CleanTalk Anti-Spam – Complete Spam Protection plugin <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk versions = 6.89.1...

CVE-2026-109198

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109198 Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-108584

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109198 Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109198

The Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.89.1 . The root cause is insufficient input sanitization and output escaping of the user_email parameter. An unauthenticated attacker can inject arbitrary web s...

WordPress CleanTalk Anti cross-site scripting vulnerability

WordPress CleanTalk Anti versions 6.89.1 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping; it results in stored cross-site scripting via the ‘useremail’ parameter. Unauthenticated attackers can inject arbitrary web...

PT-2026-121756

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-103424

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-103424

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 6.88 . The root cause is insufficient input sanitization and output escaping of the 'comment' parameter . An una...

EUVD-2026-96064

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for...