PLUGIN SECURITY
Is Cleantalk Spam Protect safe?
Advanced anti-spam protection for comments, users & contact forms, with Spam FireWall and cloud filtering. We catch spam others miss!
What this plugin does
- Slug:
cleantalk-spam-protect - Author: CleanTalk Inc
- 200000+ active installs
- 96/100 rating (3219 reviews on wordpress.org)
- 25778818 all-time downloads
- On WordPress.org since 2012-05-18
anti-spamantispamcaptchaspamspam protection
Maintenance status
- Latest known version: 6.85
- Last updated: 2026-10-20 9:13pm GMT
- Tested up to WordPress: 7.1.3
- Requires PHP: 7.2+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
18 known CVEs on file for Cleantalk Spam Protect.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-109198 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.90 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 6.90 | 6.90 | 2026-10-09 | ⚠ update needed |
| CVE-2026-103424 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.89 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 6.89 | 6.89 | 2026-09-07 | ⚠ update needed |
| CVE-2026-19855 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.87 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Medium 6.5 | < 6.87 | 6.87 | 2026-09-04 | ⚠ update needed |
| CVE-2026-77830 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.87 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 6.87 | 6.87 | 2026-07-27 | ⚠ update needed |
| CVE-2026-65437 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.83 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 6.83 | 6.83 | 2026-06-11 | ✓ fixed in latest |
| CVE-2026-8071 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 6.79 | 6.79 | 2026-06-10 | ✓ fixed in latest |
| CVE-2024-10542 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.44 | Missing Authorization | Critical 9.8 | < 6.44 | 6.44 | 2024-11-25 | ✓ fixed in latest |
| CVE-2024-10781 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.45 | Improper Check or Handling of Exceptional Conditions | High 8.1 | < 6.45 | 6.45 | 2024-11-25 | ✓ fixed in latest |
+ 16 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2023-51696 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.21 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 6.21 | 6.21 | 2023-12-27 | ✓ fixed in latest |
| CVE-2023-51535 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.21 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 6.21 | 6.21 | 2023-12-27 | ✓ fixed in latest |
| CVE-2023-33996 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.11 | Missing Authorization | High 8.8 | < 6.11 | 6.11 | 2023-06-22 | ✓ fixed in latest |
| CVE-2022-3302 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.185.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 5.185.1 | 5.185.1 | 2022-10-03 | ✓ fixed in latest |
| CVE-2022-28222 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.174.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 5.174.1 | 5.174.1 | 2022-03-30 | ✓ fixed in latest |
| CVE-2022-28221, CVE-2022-28222 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.174.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 5.174.1 | 5.174.1 | 2022-03-30 | ✓ fixed in latest |
| CVE-2021-24295 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.153.4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 5.153.4 | 5.153.4 | 2021-03-05 | ✓ fixed in latest |
| CVE-2021-24131 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.149 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 5.149 | 5.149 | 2020-11-20 | ✓ fixed in latest |
| — | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.149 | — | Unknown | < 5.149 | 5.149 | 2020-11-20 | ✓ fixed in latest |
| CVE-2019-17515 | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.127.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 5.127.4 | 5.127.4 | 2019-11-12 | ✓ fixed in latest |
| — | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.22 | — | Unknown | < 5.22 | 5.22 | 2015-08-25 | ✓ fixed in latest |
| — | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.22 | — | Unknown | < 5.22 | 5.22 | 2015-08-25 | ✓ fixed in latest |
| — | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 6.72 | Reliance on Reverse DNS Resolution for a Security-Critical Action | Critical 9.8 | < 6.72 | 6.72 | 0000-00-00 | ✓ fixed in latest |
| — | CleanTalk Anti-Spam – Complete Spam Protection [cleantalk-spam-protect] < 5.22 | — | Unknown | < 5.22 | 5.22 | — | ✓ fixed in latest |
| — | Anti-Spam by CleanTalk < 5.22 - Unauthenticated Reflected Cross-Site Scripting (XSS) | — | Unknown | < 5.22 | 5.22 | — | ✓ fixed in latest |
| CVE-2026-1490 | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.72 - Unauthenticated Arbitrary Plugin Installation | — | Unknown | < 6.72 | 6.72 | — | ✓ fixed in latest |
How to fix it
Keep Cleantalk Spam Protect updated — 6.85 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Akismet Anti-spam: Spam Protection — 5000000+ active installs — 94/100 (1187) — max PHP 8.4
- Antispam Bee — 700000+ active installs — 96/100 (226) — max PHP 8.4
- WP Armour – Honeypot Anti Spam — 400000+ active installs — 100/100 (1461) — max PHP 8.4
- CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 — 300000+ active installs — 76/100 (135) — max PHP 8.4
- CloudSecure WP Security — 100000+ active installs — 100/100 (2) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.