Published October 23, 2026. Based on public CVE records available on that date; details may change.

CVE-2026-109198 is a stored cross-site scripting (XSS) flaw in the Anti-Spam by CleanTalk WordPress plugin, in all versions up to and including 6.89.1. Sites that allow open user registration are the ones exposed. Update the plugin to 6.90 or later before an administrator next runs the plugin's user spam scan.

What happened

The CVE record says the plugin does not properly sanitize and escape the user_email value supplied during user registration. Stored XSS means an attacker saves script content on the site, and that script runs later in the browser of whoever views the page where it is displayed.

According to the record, the attacker needs no account. The stored content does nothing on its own, though. It runs when an administrator does something routine: runs CleanTalk's user spam scan and then opens the resulting Non-checkable users or Spam users tab. The record points out that this is the plugin's own documented workflow, which is why it deserves attention.

Script running in an administrator's browser session acts with that administrator's access. That is the general reason admin-facing XSS is treated seriously, even when the attacker never logs in.

The record was published by Wordfence as the CVE Numbering Authority. Key details from it:

  • Affected versions: all versions up to and including 6.89.1.
  • Privileges required: none (unauthenticated), with open user registration.
  • CVSS 3.1: 7.2 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
  • Weakness: CWE-79, cross-site scripting.

The records reviewed for this article do not mention exploitation in the wild.

Who is affected

Any site running Anti-Spam by CleanTalk 6.89.1 or earlier with Anyone can register turned on is in scope for the reported attack path. On WordPress.org, the plugin uses the slug cleantalk-spam-protect and is listed as CleanTalk Anti-Spam (Complete Spam Protection). It had 200,000+ active installations on WordPress.org as of October 23, 2026.

The current release on WordPress.org is 6.90, dated October 13, 2026 in the plugin's changelog. The changelog entry does not name this CVE. Comparing the public plugin code, 6.90 adds output escaping for the email column in the user list tables that the CVE record references, which matches the reported problem.

Membership sites, WooCommerce stores that let customers create accounts, and community sites are the most likely to have registration open. Check staging copies too, since they often keep production settings.

How to check your site

Start with the plugin version, then the registration setting.

  1. In the dashboard, open Plugins and find Anti-Spam by CleanTalk. Note the version number.
  2. Open Settings, General and look at Membership. If Anyone can register is checked, registration is open.
  3. Before updating, do not run the plugin's user spam scan or open its Non-checkable users or Spam users tabs from an administrator account.

With WP-CLI, run these from the WordPress directory:

  • wp plugin list --name=cleantalk-spam-protect shows the installed version and status.
  • wp option get users_can_register returns 1 when open registration is on.
  • wp user list --orderby=registered --order=DESC --fields=ID,user_login,user_email,user_registered lists the newest accounts first.

In that user list, look for registrations you cannot explain, and for email values that contain characters a normal address would not, such as angle brackets or quotation marks. Do not open suspicious entries in the plugin's spam tabs to inspect them while an affected version is installed.

An old version does not mean your site was attacked. If you do find odd registrations, or you notice changes made under an administrator account that nobody remembers, review the site more fully. Our guide to finding hidden WordPress admin users covers one part of that review.

What to do now

Update the plugin first. Use Dashboard, Updates, or run wp plugin update cleantalk-spam-protect, and confirm the version reads 6.90 or later afterward.

Next, decide whether open registration is needed. If your site does not use customer or member accounts, turning off Anyone can register removes this attack path and reduces spam sign-ups in general. Our WordPress hardening checklist covers that setting along with other account controls.

Then handle any suspicious registrations carefully:

  1. Take a backup of files and database before removing anything, so you keep evidence.
  2. Review the newest accounts and delete only the ones you are confident are fake.
  3. Run the CleanTalk user scan only after the update.

If an administrator viewed the spam tabs while an affected version was installed and you see unexplained changes, treat it as a possible compromise. Check for new administrator accounts, changed plugin or theme files, and new options in wp_options. Rotate administrator passwords and log out all sessions. wp core verify-checksums will flag modified WordPress core files, but it does not check plugins, themes, or the database. The steps in how to fix a hacked WordPress site are a reasonable starting point.

When to get help

Get help if your site had open registration on an affected version and you cannot account for recent accounts, administrator activity, or file changes. Our WordPress malware removal service handles suspected compromises, and a security audit can review registration, roles, and plugin exposure on a site that looks clean.

Sources