CVE-2026-77830: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk

CVE-2026-77830 is a stored cross-site scripting vulnerability in the CleanTalk Spam protection, Honeypot, Anti-Spam plugin for WordPress. The flaw arises from insufficient input sanitization and output escaping of the comment content's aria-label placeholder, allowing authenticated users with custom-level access or above to inject arbitrary web scripts. These scripts execute in the context of non-logged-in visitors when they access the injected pages. The vulnerability affects all plugin versions up to and including 6.86. If comment moderation is enabled, an approving moderator must publish the malicious comment before the payload is delivered to other users.

An attacker with authenticated access at custom-level or higher can inject malicious scripts that execute in the browsers of non-logged-in visitors, potentially leading to information disclosure or session hijacking. The vulnerability does not affect logged-in users and requires comment approval if moderation is enabled, which limits immediate exploitation. The CVSS v3.1 base score is 7.2, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required for exploitation, no user interaction, and impact on confidentiality and integrity but not availability.

No official patch or fix information is provided in the vendor advisory or patch links. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider enabling strict comment moderation to prevent untrusted comments from being published without review. Additionally, restricting custom-level access to trusted users can reduce the risk of exploitation.