Is Anti-Spam, Spam FireWall by CleanTalk safe?

Every recorded flaw

• Oct 23, 2026Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA: Stored Cross-Site ScriptingCVE-2026-109198 · affects up to 6.89.1 · reported by WordfenceHigh 7.2
• Oct 10, 2026Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA: Stored Cross-Site ScriptingCVE-2026-103424 · affects up to 6.88 · reported by WordfenceMedium 5.4
• Sep 9, 2026CleanTalk: Does not prevent unauthenticatedCVE-2026-19855 · fixed in 6.87 · reported by WPScanMedium 6.5
• Sep 5, 2026Spam protection, Honeypot, Anti-Spam by CleanTalk: Stored Cross-Site ScriptingCVE-2026-77830 · affects up to 6.86 · reported by WordfenceHigh 7.2
• Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.CVE-2026-65437 · affects up to 6.82 · reported by PatchstackHigh 7.1
• Jun 10, 2026Anti-Spam by CleanTalk. Spam protection: Does not properly sanitize content within a custom shortcode used in its email-encoding featureCVE-2026-8071 · fixed in 6.79 · reported by WPScanHigh 8.8
• Feb 14, 2026Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2026-1490 · affects up to 6.71 · reported by Wordfence1.3% oddsCritical 9.8
• Dec 13, 2024Spam protection, AntiSpam, FireWall by CleanTalk: Missing AuthorizationCVE-2023-33996 · affects up to 6.10 · reported by PatchstackHigh 8.8
• Nov 26, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2024-10781 · affects up to 6.44 · reported by Wordfence3.7% oddsHigh 8.1
• Nov 26, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2024-10542 · affects up to 6.43.2 · reported by Wordfence15% oddsCritical 9.8
• Feb 29, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Cross-Site Request Forgery (CSRF)CVE-2023-51696 · affects up to 6.20 · reported by PatchstackMedium 4.3
• Jan 5, 2024Spam protection, Anti-Spam, FireWall by CleanTalk: Cross-Site Request Forgery (CSRF)CVE-2023-51535 · affects up to 6.20 · reported by PatchstackMedium 4.3
• Oct 25, 2022Spam protection, AntiSpam, FireWall by CleanTalk: Does not validate ids before using them in a SQL statementCVE-2022-3302 · fixed in 5.185.1 · reported by WPScan1.3% oddsHigh 7.2
• May 17, 2021It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress PluCVE-2021-24295 · fixed in 5.153.4 · reported by WPScan4.7% oddsHigh 7.5
• Mar 18, 2021Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, CVE-2021-24131 · fixed in 5.149 · reported by WPScan1.4% oddsHigh 7.2
• Nov 13, 2019The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS).CVE-2019-17515 · fixed in 5.127.4 · reported by MITRE1.3% oddsMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.