WordPress Anti-Spam Plugin Stored XSS via Shortcode

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Anti-Spam by CleanTalk plugin before version 6.79 contains a stored cross-site scripting (XSS) vulnerability in its email-encoding shortcode feature. Because the plugin fails to properly sanitize user-supplied content within this shortcode, attackers can inject malicious JavaScript that persists in approved comments. Any user viewing the affected post—including administrators with elevated privileges—will execute the attacker's script in their browser context. With a CVSS score of 8.8, this vulnerability poses significant risk to WordPress sites using this popular security plugin, potentially leading to credential theft, privilege escalation, or further compromise of site administrators.

Casky's 301 mapped skills leverage Claude's extended reasoning to detect attack chains associated with TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky will identify suspicious patterns including: improper input validation in shortcode handlers (CWE-79 classification), unexpected script tags appearing in comment metadata, and anomalous administrator session activity triggered by comment views. The platform's skill set tracks how attackers probe for vulnerable plugin versions during reconnaissance, then exploit the sanitization gap to inject payloads. Security teams will see findings highlighting unsanitized shortcode parameters, stored malicious scripts in the comments table, and execution paths where unauthenticated input reaches DOM-rendering functions—enabling defenders to patch before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-8071.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-8071

Casky has 301 skills that investigate the attack patterns behind CVE-2026-8071. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn