Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-17515: CleanTalk Spam Protect plugin can run malicious code

CVE-2019-17515 · published 6 years ago

Summary

The CleanTalk spam protection plugin for WordPress may let an attacker inject and run unwanted HTML or JavaScript when an administrator clicks a specially crafted link. This could change what the admin sees or perform actions on their behalf. Update the plugin to the latest version (5.127.4 or newer) to close the risk.

What to do

Update cleantalk spam_protection\,_antispam\,_firewall to version 5.127.4 or later.

Affected software

Vendor	Product	Affected versions
cleantalk	spam_protection\,_antispam\,_firewall	< 5.127.4 `cpe:2.3:a:cleantalk:spam_protection\,_antispam\,_firewall::::::wordpress::*`

Original advisory text

The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and inc/cleantalk-comments.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.

References

https://plugins.trac.wordpress.org/changeset/2172333 Patch Third Party Advisory
https://wordpress.org/plugins/cleantalk-spam-protect/#developers Product Third Party Advisory
https://wpvulndb.com/vulnerabilities/9949 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published13 Nov 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-17515 · NVD

Track software like this

Free during beta