PT-2026-22085 · Drupal+3 · Cleantalk Antispam+3

Damien Mckenna + 6 · CVE-2026-3213 · Published 2026-02-25 · Updated 2026-03-30

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Anti-Spam by CleanTalk versions prior to 9.7.0

Description The software contains a flaw related to improper handling of user-supplied data during web page creation, which could allow for Cross-Site Scripting (XSS) attacks. The issue exists because the software does not adequately sanitize user input. The vulnerability is limited in scope as it only affects users who are challenged or blocked by the firewall.

Recommendations Update to version 9.7.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3213

DRUPAL-CONTRIB-2026-014

Affected Products

Cleantalk Antispam

Anti-Spam

Cleantalk

Drupal/Cleantalk

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3213.json · Exploit
• https://drupal.org/sa-contrib-2026-014 · Vendor Advisory
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3213 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3213 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2038620212988146115 · Twitter Post
• https://git.drupalcode.org/project/cleantalk · Note
• https://twitter.com/CVEnew/status/2038618164787892289 · Twitter Post
• https://drupal.org/project/cleantalk · Note