WordPress security by component
cleantalk
cleantalk is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Sep 09, 2026; the highest published CVSS base score is 6.5.
Plugin slug:
cleantalkLatest vulnerability
CVE-2026-19855: CleanTalk executes shortcodes embedded in visitor comments
CleanTalk before 6.87 passes unauthenticated visitor comments to WordPress's shortcode engine. An attacker can insert registered shortcodes that execute server-side and render to subsequent page visitors; the impact depends on what those shortcode handlers expose or change.
| Safe version |
|
||
|---|---|---|---|
| Sep 09, 2026 |
CVE-2026-19855
CleanTalk executes shortcodes embedded in visitor comments
CleanTalk before 6.87 passes unauthenticated visitor comments to WordPress's shortcode engine. An attacker can insert registered shortcodes that execute server-side and render to subsequent page visitors; the impact depends on what those shortcode handlers expose or change.
|
6.87 |
CVE6.5
|