What’s Vulnerable › Vulnerabilities

CVE-2019-17515

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-13 · updated 2026-06-17
• Weakness: CWE-79

Description

The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and inc/cleantalk-comments.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.

Affected products

• Spam protection, AntiSpam, FireWall by CleanTalk: before 5.127.4 — fixed in 5.127.4

How to fix

Upgrade to a fixed version: Spam protection, AntiSpam, FireWall by CleanTalk 5.127.4. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2172333
• https://wordpress.org/plugins/cleantalk-spam-protect/#developers
• https://wpvulndb.com/vulnerabilities/9949
• https://plugins.trac.wordpress.org/changeset/2172333
• https://wordpress.org/plugins/cleantalk-spam-protect/#developers
• https://wpvulndb.com/vulnerabilities/9949

Get alerted when CVE-2019-17515 or the next vulnerability affects your stack