This vulnerability (CVE-2026-10770) in the Drupal Anti-Spam by CleanTalk module is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which leads to reflected cross-site scripting (XSS). The issue allows attackers to inject malicious scripts via crafted input that is not properly sanitized before being included in web pages. Affected versions include all releases from 0.0.0 up to 9.7.1. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No official fix or patch is currently documented, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session when they visit a crafted URL or web page. This can lead to information disclosure or manipulation of user interactions within the affected Drupal module. The impact is limited to confidentiality and integrity with no direct availability impact. The attack requires user interaction (e.g., clicking a malicious link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's security advisories for updates. Until a patch is available, consider applying input validation or output encoding workarounds if feasible, and limit exposure by restricting access to the affected module where possible.