Anti-Spam by CleanTalk EUVD-2026-43048

Exploitation requires the target Drupal site to have the Anti-Spam by CleanTalk contributed module installed, enabled, and running a version from 0.0.0 up to 9.7.1. No authentication or site account is required from the attacker (PR:N per CVSS vector). However, successful impact depends on user interaction (UI:R): a victim must follow or otherwise load a crafted URL containing the reflected payload - this is the primary limiting factor against automated or mass exploitation. The specific endpoint or parameter within the module that reflects unsanitized input is not disclosed in the Drupal advisory or any available reference, which raises the reconnaissance burden for opportunistic attackers. Exploitation impact is highest when the victim is an authenticated Drupal user with elevated roles (editor, administrator), as their session tokens carry greater access.

The CVSS 6.1 Medium score is well-calibrated for this class of vulnerability. Network attack vector (AV:N) and no required privileges (PR:N) mean any internet-reachable Drupal site is a valid target surface, but the mandatory user interaction (UI:R) is a meaningful exploitation barrier that prevents automated scanning or exploitation without a social-engineering step. EPSS at 0.16% (6th percentile) is low and consistent with a medium-severity XSS in a niche contributed module - not a high-value mass-exploitation target. There is no CISA KEV listing and no known POC, confirming this is not being actively weaponized at time of analysis. Real-world priority sits in the 'patch on your next maintenance cycle' tier: the plugin is not Drupal core, the attack is user-interaction-dependent, and the C/I impact is low (no direct data exfiltration from the server). However, if administrators or privileged Drupal users are the likely phishing targets, the effective impact escalates because their session tokens carry higher access.

An attacker enumerates a Drupal site running a vulnerable version of Anti-Spam by CleanTalk, then crafts a URL containing a reflected XSS payload embedded in a vulnerable query parameter handled by the module. The attacker delivers this link to a targeted Drupal administrator or editor via a phishing email or compromised third-party site. When the victim clicks the link and loads the page while authenticated to Drupal, the unsanitized input is reflected in the response and the injected script executes in their browser, exfiltrating the session cookie to an attacker-controlled endpoint and granting the attacker the victim's Drupal session.