WordPress security by component

Spam protection, AntiSpam, FireWall by CleanTalk

Plugin description

Spam protection, AntiSpam, FireWall by CleanTalk is a WordPress component with 8 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 9.8.

Plugin slug: cleantalk-spam-protect

Latest vulnerability

CVE-2026-65437: CleanTalk public input permits cross-site scripting

CleanTalk through 6.82 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.

PublishedJul 27, 2026

Known safe version6.83

		Safe version
Jul 27, 2026	CVE-2026-65437 CleanTalk public input permits cross-site scripting CleanTalk through 6.82 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin. The Patchstack CNA record does not disclose whether the payload is reflected or stored, or identify the endpoint, action, parameter or rendering function.	6.83	CVE7.1 NVDPending
Feb 15, 2026	CVE-2026-1490 Spam protection, Anti-Spam, FireWall by CleanTalk: Code execution Spam protection, Anti-Spam, FireWall by CleanTalk is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE9.8 NVDPending
Dec 13, 2024	CVE-2023-33996 Spam protection, AntiSpam, FireWall by CleanTalk: A security weakness Spam protection, AntiSpam, FireWall by CleanTalk is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE8.8 NVDPending
Nov 26, 2024	CVE-2024-10781 Spam protection, Anti-Spam, FireWall by CleanTalk: Code execution Spam protection, Anti-Spam, FireWall by CleanTalk is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.1 NVD7.5
Nov 26, 2024	CVE-2024-10542 Spam protection, Anti-Spam, FireWall by CleanTalk: Code execution Spam protection, Anti-Spam, FireWall by CleanTalk is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE9.8 NVD7.5
Feb 29, 2024	CVE-2023-51696 Spam protection, Anti-Spam, FireWall by CleanTalk: Cross-site request forgery Spam protection, Anti-Spam, FireWall by CleanTalk is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8
Jan 05, 2024	CVE-2023-51535 Spam protection, Anti-Spam, FireWall by CleanTalk: Cross-site request forgery Spam protection, Anti-Spam, FireWall by CleanTalk is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8
Nov 13, 2019	CVE-2019-17515 Cleantalk Spam Protect: Cross-site scripting Cleantalk Spam Protect is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVD6.1