Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.87 - Unauthenticated Stored Cross-Site Scripting via Contact Encoder Shortcode Placeholders
- ID
- WPSEC-2026-0188
- Plugin
- Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA (cleantalk-spam-protect)
- Affected
- all versions before 6.88
- Remediation
- Update to 6.88 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Spam protection, Honeypot, Anti-Spam by CleanTalk on WPSec AttackSurface
- Fix released
- Published
Description
The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Encoder shortcode placeholders in all versions up to, and including, 6.87. Before contact encoding, the plugin swaps the content of its [apbct_skip_encoding] and [apbct_encode_data] shortcodes for predictable placeholders (for example %%APBCT_SHORT_CODE_SKIP_EE_0%%). Afterwards it copies the content back with a plain string replacement, and it did so even when a shortcode pair contained HTML. This makes it possible for unauthenticated attackers to post a comment containing such a shortcode pair together with the matching placeholder text inside an HTML attribute. When the comment is displayed, the shortcode's markup is copied into that attribute, which breaks out of it and allows arbitrary attributes such as event handlers to be injected. Exploitation requires the contact data encoding feature (enabled by default). The comments must be rendered by a block-based comment template (as in block themes), or by the optional buffer mode on a theme whose comment list lacks the standard comment-list markup. The comment must also be published, so comment moderation may apply. In buffer mode, an unbalanced shortcode pair can also capture and re-render surrounding page markup.
References
- https://wpsec.com/vuln/WPSEC-2026-0188/
- https://plugins.svn.wordpress.org/cleantalk-spam-protect/tags/6.88/
- https://wordpress.org/plugins/cleantalk-spam-protect/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS