CVE-2026-19855: Unknown Cleantalk

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

Affected products

• Unknown Cleantalk: before 6.87 (fixed in 6.87)

Published 2026-09-09. Last modified 2026-09-09.