Cross-Site Scripting in Drupal Anti-Spam by CleanTalk
CVE-2026-3213

4.7MEDIUM

Key Information:

Vendor

Drupal
Status
Anti-spam By Cleantalk
Vendor
CVE Published:
25 March 2026

What is CVE-2026-3213?

The Anti-Spam module by CleanTalk for Drupal contains a vulnerability that arises from improper neutralization of user input data during the generation of web pages. This flaw allows attackers to inject malicious scripts into web pages viewed by other users, facilitating unauthorized actions and data theft. The issue affects versions of the module up to, but not including, 9.7.0, making it crucial for users of these versions to implement the necessary updates or mitigations to safeguard their applications.

Affected Version(s)

Anti-Spam by CleanTalk 0.0.0 < 9.7.0

References

https://www.drupal.org/sa-contrib-2026-014

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
glomberg
Drew Webber (mcdruid)
sergefcleantalk
Damien McKenna (damienmckenna)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
Jess (xjm)
.