The CleanTalk Anti‑Spam, Spam FireWall plugin before version 6.91 fails to escape a commenter‑supplied email address that is displayed on the administrative spam‑review screen. An unauthenticated user can submit a comment with a crafted email containing JavaScript, which is stored and rendered when an administrator reviews flagged comments. In the administrator’s browser the injected script runs with the privileges of the admin session, potentially allowing cookie theft, session hijacking, or arbitrary script execution on the site’s backend interface.

WordPress sites running the CleanTalk Anti‑Spam or Spam FireWall plugin with a version earlier than 6.91 are affected. The vulnerability exists in the plugin’s handling of the comment author email field in the spam‑review page.

There is no EPSS score or KEV listing available, but stored XSS represents a high severity risk because it does not require authentication to inject the attack. An attacker can simply post a comment from any IP to trigger the script when an administrator opens the review screen. The attack vector is via the public comment form, and exploitation requires no special privileges beyond normal comment submission. The lack of an official CVSS score does not diminish the practical danger of the flaw, as it can lead to full compromise of the administrative interface if the attacker delivers malicious payloads.