CVE-2026-77830

The Spam protection, Honeypot, Anti-Spam by CleanTalk WordPress plugin, in all versions up to and including 6.86, fails to adequately sanitize and escape the Comment Content aria-label placeholder, allowing arbitrary web scripts to be stored in pages. The payload can be delivered through an unauthenticated comment submission, and when comment moderation is enabled, an approving moderator must first publish the comment before the injected script reaches other users. Once the comment is live, the injected script executes in the browsers of non-logged-in visitors only, letting an attacker run arbitrary JavaScript against anonymous visitors, such as redirecting them, injecting malicious content, or performing actions in their session context. Any WordPress site running the plugin at version 6.86 or earlier is affected. No public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS indicates a low (~0.3%) probability of exploitation in the next 30 days, so no exploitation is currently known.

What to do: Update the CleanTalk anti-spam plugin to a version newer than 6.86 (the latest patched release). Until patched, consider holding comments in moderation and reviewing the moderation queue for comments containing HTML or script-like content before approving, and avoid approving unfamiliar comments. Note that logged-in users (including moderators and commenters) will not trigger the injected script, so test affected pages in a logged-out browser when verifying.