CVE-2026-103424: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cleantalk Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA

CVE-2026-103424 is a stored cross-site scripting vulnerability in the Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA WordPress plugin. The flaw arises from insufficient input sanitization and output escaping of the 'comment' parameter, enabling unauthenticated attackers to inject arbitrary web scripts. The vulnerability affects all plugin versions from 0 up to and including 6.88. Exploitation depends on approval of an initial comment from the attacker’s email address, after which subsequent comments auto-approve on default WordPress installations, allowing immediate execution of injected scripts in users' browsers.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user data, hijack sessions, or perform actions on behalf of users. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), indicating limited complexity but requiring user interaction and some conditions for exploitation.

No official patch or fix information is provided in the vendor advisory or source data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider disabling the plugin or restricting comment approvals to trusted users to prevent attacker comments from being approved. Monitoring and manual moderation of comments from new email addresses can reduce exposure.