CVE-2026-115673

HighCVSS 7.5/10Last modified Nov 6, 2026

Description

The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Anti-Spam, Spam FireWall by CleanTalk	< 6.91

References

https://wpscan.com/vulnerability/087d91ac-2158-4f9b-8fab-4d17b14a7053/

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1156785.3Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing CVE-2026-1156796.5Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer CVE-2026-115687.5The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before return CVE-2026-1156806.5Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission CVE-2026-1156836.8A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world s CVE-2026-115695.4A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository wri CVE-2026-1156939.1Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to CVE-2026-11578.8A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecg CVE-2026-115704.2The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured dis CVE-2026-1157006.9Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed I CVE-2026-1157018.2Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust CVE-2026-1157066.8Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege