The vulnerability arises from insufficient input sanitization of the user_email field in the CleanTalk Anti‑Spam plugin. An attacker who can register a new user account can inject arbitrary JavaScript code into this field, and the payload is later stored and rendered when an Administrator runs the plugin’s user‑spam scan and views the Non‑checkable or Spam users tab. The impact is that the injected script will execute in the context of the Administrator’s browser session.

CleanTalk Anti‑Spam – Complete Spam Protection for WordPress, all releases up to and including version 6.89.1.

With a CVSS score of 7.2, the vulnerability is moderate‑to‑high severity. No EPSS data or KEV listing is available, so the likelihood of exploitation in the wild is unclear. The flaw can be exploited without authentication, but requires the site to allow open user registration and for an Administrator to subsequently run the plugin’s scan. These conditions are common in many WordPress installations, making the attack path relatively straightforward for a motivated adversary.