CVE-2026-19855 — Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment…

CVE-2026-19855

Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text PUBLISHED

Description (CNA)

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

Affected (CNA)

Vendor / product	Versions
Unknown / CleanTalk	affected 0 before 6.87

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c27f3657-261a-46cd-860c-0bdf5c849190/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.