Skip to content
Noroxi

Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA

cleantalk-spam-protect · plugin

Known security vulnerabilities for Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA. Find out in seconds which version runs on your site with WP Lens.

9 known vulnerabilities

1 critical · 8 exploitable without logging in · 1 with public exploit code · latest Sep 5, 2026

Listed on wordpress.org · latest 6.88 · last updated Sep 30, 2026 · 200K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2026-1490unauthenticated≤ 6.71

    Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Insta

    Critical 9.8

  • CVE-2023-51696unauthenticated · needs a click≤ 6.20

    WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2023-51535unauthenticated · needs a click≤ 6.20

    WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2023-33996login required≤ 6.10

    WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.10 - Broken Access Control vulnerability

    High 8.8

  • CVE-2024-10781unauthenticated≤ 6.44

    Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installati

    High 7.5

  • CVE-2024-10542unauthenticated≤ 6.43.2

    Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation

    High 7.5

  • CVE-2026-77830unauthenticated≤ 6.86

    Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

    High 7.2

  • CVE-2026-65437unauthenticated · needs a click≤ 6.82

    WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2019-17515unauthenticated · needs a click

    The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS).

    Medium 6.1

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory