Anti-Spam by CleanTalk WordPress plugin stored cross-site scripting (XSS) flaw
A WordPress comment-spam blocker can let attackers take over an admin's browser.
Summary
Before version 6.91, the Anti-Spam by CleanTalk WordPress plugin outputs a commenter-supplied value on the admin spam-review screen without escaping it. An unauthenticated user can plant malicious scripts that run in the browser of an administrator who reviews flagged comments.
Affected when
- an admin opens the spam-review screen for flagged comments
What to do
Update to version 6.91 or newer.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen