What this plugin does

• Slug: cleantalk-spam-protect
• Author: CleanTalk Inc
• 200000+ active installs
• 96/100 rating (3205 reviews on wordpress.org)
• 25057014 all-time downloads
• On WordPress.org since 2012-05-18

antispambotcaptchahoneypotspam

Maintenance status

• Latest known version: 6.85
• Last updated: 2026-08-19 8:12am GMT
• Tested up to WordPress: 7.1
• Requires PHP: 7.2+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

14 known CVEs on file for Cleantalk Spam Protect.

+ 12 more known vulnerabilities

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2022-28222	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 5.174.1	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 5.174.1	5.174.1	2022-03-30	✓ fixed in latest
CVE-2022-28221, CVE-2022-28222	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 5.174.1	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 5.174.1	5.174.1	2022-03-30	✓ fixed in latest
CVE-2021-24295	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 5.153.4	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 7.5	< 5.153.4	5.153.4	2021-03-05	✓ fixed in latest
CVE-2021-24131	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 5.149	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 7.2	< 5.149	5.149	2020-11-20	✓ fixed in latest
—	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 5.149	—	Unknown	< 5.149	5.149	2020-11-20	✓ fixed in latest
CVE-2019-17515	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 5.127.4	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 5.127.4	5.127.4	2019-11-12	✓ fixed in latest
—	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 5.22	—	Unknown	< 5.22	5.22	2015-08-25	✓ fixed in latest
—	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 5.22	—	Unknown	< 5.22	5.22	2015-08-25	✓ fixed in latest
—	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 6.72	Reliance on Reverse DNS Resolution for a Security-Critical Action	Critical 9.8	< 6.72	6.72	0000-00-00	✓ fixed in latest
—	Spam protection, Honeypot, Anti-Spam by CleanTalk [cleantalk-spam-protect] < 5.22	—	Unknown	< 5.22	5.22	—	✓ fixed in latest
—	Anti-Spam by CleanTalk < 5.22 - Unauthenticated Reflected Cross-Site Scripting (XSS)	—	Unknown	< 5.22	5.22	—	✓ fixed in latest
CVE-2026-1490	Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.72 - Unauthenticated Arbitrary Plugin Installation	—	Unknown	< 6.72	6.72	—	✓ fixed in latest

How to fix it

Keep Cleantalk Spam Protect updated — 6.85 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.

Safer / more established alternatives

• Akismet Anti-spam: Spam Protection — 5000000+ active installs — 94/100 (1186) — max PHP 8.4
• Antispam Bee — 700000+ active installs — 96/100 (226) — max PHP 8.4
• reCaptcha by BestWebSoft — 100000+ active installs — 78/100 (391) — max PHP 8.4
• hCaptcha for WP — 70000+ active installs — 92/100 (86)
• Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter — 50000+ active installs — 90/100 (369)