Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 598

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.2	CVE-2026-109198	The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up... cleantalkCleanTalk Anti-Spam – Complete Spam Protection, cleantalk Anti-Spam by CleanTalk	NVD	Oct 23 05:17 UTC
CVE-2026-109198The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up... Executive summary The Anti-Spam by CleanTalk WordPress plugin contains a stored cross-site scripting flaw that affects all versions up to and including 6.89.1. An unauthenticated attacker can plant malicious scripts that run in an administrator's browser when that administrator reviews spam users in the plugin, which requires open user registration on the site. The advisory does not state a severity rating or a fixed version. Technical summary The flaw is stored cross-site scripting caused by insufficient input sanitization and output escaping of the 'user_email' parameter. An unauthenticated attacker can exploit it if user registration is open on the site. The script executes when an Administrator runs the plugin's user-spam scan and views the Non-checkable users or Spam users tab. Affected versions are stated as all versions up to and including 6.89.1. A fixed version, workaround, CVSS score, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Affects cleantalk CleanTalk Anti-Spam – Complete Spam Protection cleantalk Anti-Spam by CleanTalk NIST National Vulnerability DatabasePublished Oct 23, 2026 05:17 UTC Read the advisory
	Medium	5.4	CVE-2026-103424	The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up... cleantalkcleantalk Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA	NVD	Oct 10 05:16 UTC
CVE-2026-103424The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up... From the advisory The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable once a comment from the attacker's email address has been approved; on default WordPress installations, only the first comment from a given email address is held for moderation, meaning subsequent comments auto-approve and immediately expose the payload to site visitors. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Affects cleantalk cleantalk Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA NIST National Vulnerability DatabasePublished Oct 10, 2026 05:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee