CVE-2026-10770

MediumCVSS 6.1

Published: 10/07/2026(UTC)Updated: 06/08/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The Anti-Spam by CleanTalk plugin for Drupal contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from 0.0.0 to 9.7.1.

Risk Assessment

An attacker can inject malicious scripts into server responses, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.

Recommendation

Immediately update the Anti-Spam by CleanTalk plugin to version 9.7.2 or later, which includes a fix for this vulnerability.

Other vulnerabilities in Anti-Spam by CleanTalk

CVE-2026-8071High
Vulnerability in the Anti-Spam by CleanTalk WordPress plugin before version 6.79: improper content sanitization in a custom shortcode used in email encoding. Unauthenticated attackers can inject arbitrary web scripts into approved comments.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.