The vulnerability resides in the Anti‑Spam by CleanTalk plugin before version 6.79. The plugin’s custom shortcode used for email‑encoding fails to sanitize its content, so an unauthenticated attacker can inject arbitrary JavaScript into approved comments. When any user, including administrators, views the post, the malicious script executes in the victim’s browser, enabling cookie theft, defacement, or further session hijacking. The weakness is a classic stored XSS flaw as defined by CWE‑79.

WordPress sites running the Anti‑Spam by CleanTalk. Spam protection plugin, any version earlier than 6.79. The plugin’s vendor is not explicitly listed, but it is a public WordPress plugin widely used for comment moderation.

The vulnerability is exploitable by anyone who can post a comment that contains the malicious shortcode, which requires no authentication. The EPSS score is not available, and the issue is not listed in CISA KEV, so the exploitation probability is unknown but potentially high due to the simple unauthenticated nature of the attack. Administrators should act promptly because the script runs automatically when users visit the infected post, compromising confidentiality, integrity, and availability of the site.