MEDIUM 6.5 NVD

CVE-2026-19855

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, al

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

References

https://wpscan.com/vulnerability/c27f3657-261a-46cd-860c-0bdf5c849190/

Published: 2026-09-09 · Source: NVD · Feed updated: 2026-09-11

This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-09-09 via NVD.

vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.