CVE-2026-10770
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Anti-Spam by CleanTalk plugin for Drupal contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from 0.0.0 to 9.7.1.
Risk Assessment
An attacker can inject malicious scripts into server responses, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the Anti-Spam by CleanTalk plugin to version 9.7.2 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Anti-Spam by CleanTalk
See all- CVE-2026-103424Medium
The Anti-Spam by CleanTalk plugin for WordPress up to version 6.88 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is exploitable once a comment from the attacker's email is approved; on default WordPress installations, only the first comment from a given email is moderated, and subsequent comments auto-approve.
- CVE-2026-8071High
Vulnerability in the Anti-Spam by CleanTalk WordPress plugin before version 6.79: improper content sanitization in a custom shortcode used in email encoding. Unauthenticated attackers can inject arbitrary web scripts into approved comments.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS