CVE-2026-10770

Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.

PUBLISHED Reserved 2026-06-03 | Published 2026-07-10 | Updated 2026-07-14 | Assigner drupal

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Product status

Credits

Ra Mänd (ram4nd) finder

alexandergull remediation developer

anton1211 remediation developer

Ra Mänd (ram4nd) remediation developer

Neil Drumm (drumm) coordinator

Greg Knaddison (greggles) coordinator

Juraj Nemec (poker10) coordinator

References

www.drupal.org/sa-contrib-2026-042

cve.org (CVE-2026-10770)

nvd.nist.gov (CVE-2026-10770)

Download JSON