CVE-2026-109198: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cleantalk CleanTalk Anti-Spam – Complete Spam Protection

CVE-2026-109198 is a stored cross-site scripting vulnerability (CWE-79) in the CleanTalk Anti-Spam WordPress plugin affecting versions up to 6.89.1. The flaw arises from improper neutralization of input in the 'user_email' parameter, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires open user registration and is triggered when an administrator accesses the Non-checkable users or Spam users tabs during a user-spam scan, causing the malicious script to execute in the administrator's browser context.

Successful exploitation can lead to execution of arbitrary scripts in the context of an administrator's browser, potentially allowing theft of credentials, session hijacking, or other actions limited by the administrator's privileges. The vulnerability requires open user registration and administrator interaction with the plugin's user-spam scan interface to trigger the payload. There is no indication of impact on availability.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, it is recommended to disable user registration if not needed and restrict administrator access to the plugin's user-spam scan interface. Monitoring for plugin updates and applying them promptly when released is advised.