This vulnerability is an unauthenticated Cross Site Scripting flaw in the WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin, impacting all versions up to and including 6.82. An attacker who can submit content to the site can inject malicious JavaScript that will execute in the browser of any user viewing the affected page. The injection can be used to steal session cookies, deface the site, or redirect visitors to malicious sites. The flaw is identified as CWE‑79, an input validation weakness that allows unsanitized data to be reflected or stored.

Affected systems are WordPress installations that use the CleanTalk Spam protection, AntiSpam, FireWall by CleanTalk plugin version 6.82 or earlier. The vulnerability exists in all releases from the first version up to and including 6.82; updates to 6.83 or later eliminate the flaw.

The CVSS score for this issue is 7.1, indicating a high severity. The EPSS score of <1% (0.00146) indicates a very low but non‑zero likelihood of exploitation. Despite this low probability, the lack of authentication and ability to inject arbitrary script make it a strong target for attackers. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves any actor who can submit data to the plugin’s input fields, such as comment areas or spam‑filter interfaces.