CVE-2026-8071 is a high-severity Cross-Site Scripting (CWE-79) vulnerability in the Anti-Spam by CleanTalk WordPress plugin prior to version 6.79. The vulnerability is due to insufficient sanitization of content in a custom shortcode related to the email-encoding feature. An unauthenticated attacker can exploit this flaw to inject malicious scripts into comments that have been approved, leading to script execution in the context of any user viewing the post. This can result in full confidentiality, integrity, and availability impact as indicated by the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of users viewing the affected posts, including administrators. This can lead to theft of sensitive information, session hijacking, and potentially full site compromise due to the high confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 6.79, upgrading to version 6.79 or later is likely the intended remediation once officially released. Until then, restrict comment approvals and monitor for suspicious activity related to comment content. Avoid interacting with untrusted comments containing the vulnerable shortcode.