The vulnerability resides in the CleanTalk Anti‑Spam plugin before version 6.79. The plugin’s custom shortcode used for email‑encoding does not properly sanitize its content, allowing an unauthenticated attacker to embed arbitrary JavaScript into approved comments. When any user, including administrators, views the affected post, the malicious script executes in the victim’s browser, enabling cookie theft, session hijacking, defacement, or other attacks. This is a classic stored cross‑site scripting flaw as defined by CWE‑79.

Any WordPress site that has installed the CleanTalk Anti‑Spam by CleanTalk plugin in a version earlier than 6.79. The plugin is distributed through the WordPress plugin repository and its vendor is not explicitly listed in the CVE data.

The attack is performed by submitting a normal comment containing the malicious shortcode, which requires no authentication. The EPSS score is not available and the issue is not in the CISA KEV catalog, yet the simplicity of the attack vector suggests a potentially high exploitation probability. Once a visitor loads the infected post, the injected script runs in their browser, compromising the confidentiality and integrity of user sessions and providing a vector for further compromise of the site.