How to Find and Remove Malicious ELF Files on Your Website: CleanTalk’s BinaryCheck Module

How to Find and Remove Malicious ELF Files on Your Website: CleanTalk’s BinaryCheck Module

Most WordPress security scanners are good at catching malicious PHP code — web shells, injected theme and plugin files, suspicious eval() calls. But attackers have another tool in their arsenal: compiled binary files in ELF format (Executable and Linkable Format) — the standard executable format for Linux. Such a file contains no readable PHP code, doesn’t match familiar signatures found in plugin source files, and often has no file extension at all — so classic file scanners simply skip right past it.

This is exactly the gap that Security by CleanTalk’s new module — BinaryCheck — was built to close.

CVE-2025-15677 – GeoDirectory < 2.8.110 – Editor+ Stored XSS – POC

CVE-2025-15677 – GeoDirectory < 2.8.110 – Editor+ Stored XSS – POC

WordPress plugins that provide business directory functionality often allow administrators and editors to customize categories, icons, images, and other visual elements. While these features improve usability, they also increase the attack surface if user-controlled input is not properly validated before being stored and rendered.

During security testing of the GeoDirectory plugin, a Stored Cross-Site Scripting (Stored XSS) vulnerability was discovered affecting versions prior to 2.8.110. The vulnerability allows an authenticated Editor (or higher) to inject malicious JavaScript into the Map Icon parameter of a Place Category. The payload is permanently stored and later executed whenever the vulnerable page is viewed by another privileged user.

Because the malicious payload is stored inside the WordPress database, every administrator who accesses the affected interface can unknowingly execute attacker-controlled JavaScript, potentially resulting in complete administrative account compromise.

CVE-2025-15675 – Charitable < 1.8.5.3 – Admin+ Stored XSS – POC

CVE-2025-15675 – Charitable < 1.8.5.3 – Admin+ Stored XSS – POC

Charitable is a widely used WordPress donation and fundraising plugin that enables organizations to create fundraising campaigns, donation forms, recurring payment options, and crowdfunding initiatives. With its drag-and-drop campaign builder and customizable templates, it is trusted by thousands of nonprofits and charities to manage online donations.

During security testing, a Stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 1.8.5.3. The vulnerability exists in the campaign builder, where the ALT Text field for campaign images fails to properly sanitize user input before storing and rendering it. As a result, an authenticated administrator can inject malicious JavaScript that is permanently stored and executed whenever the vulnerable content is rendered.

Plugin Security Certification (PSC-2026-64684): “CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7” – Version 3.6.1

Plugin Security Certification (PSC-2026-64684): “CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7” – Version 3.6.1

Contact Form 7 extensions can influence spam checks, stored submissions, redirects, and outbound webhooks. These features cross the boundary between anonymous form input, privileged records, external destinations, and front-end responses. CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 version 3.6.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64684, confirming that the plugin was reviewed from a secure code perspective with attention to public submissions, anti-spam checks, stored records, redirect targets, webhook configuration, and administrator access.

Plugin Security Certification (PSC-2026-64683): “Intuitive Custom Post Order” – Version 3.2.0

Plugin Security Certification (PSC-2026-64683): “Intuitive Custom Post Order” – Version 3.2.0

Content ordering plugins turn drag-and-drop administrator actions into persistent changes across posts, pages, taxonomies, and sites. Those updates must be limited to authorized objects and protected from forged requests. Intuitive Custom Post Order version 3.2.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64683, confirming that the plugin was reviewed from a secure code perspective with attention to reorder permissions, request integrity, object identifiers, taxonomy operations, multisite scope, and stored ordering data.

Plugin Security Certification (PSC-2026-64682): “Template Kit – Import” – Version 1.0.16

Plugin Security Certification (PSC-2026-64682): “Template Kit – Import” – Version 1.0.16

Template import tools bring structured design data and assets into a WordPress installation. Import permissions, file validation, remote resources, and the safety of stored page content all matter before an imported kit reaches the public site. Template Kit – Import version 1.0.16 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64682, confirming that the plugin was reviewed from a secure code perspective with attention to import authorization, package validation, template data, remote assets, stored content, and post-import rendering.

Plugin Security Certification (PSC-2026-64681): “CookieAdmin – Cookie Consent Banner” – Version 1.2.2

Plugin Security Certification (PSC-2026-64681): “CookieAdmin – Cookie Consent Banner” – Version 1.2.2

Cookie consent plugins render banners to every visitor and store configuration that controls scripts and consent choices. Safe public output and protected administrator settings are important for both reliability and privacy workflows. CookieAdmin – Cookie Consent Banner version 1.2.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64681, confirming that the plugin was reviewed from a secure code perspective with attention to banner configuration, consent state handling, script controls, administrator permissions, and front-end rendering.

Plugin Security Certification (PSC-2026-64680): “WooCommerce Legacy REST API” – Version 1.0.5

Plugin Security Certification (PSC-2026-64680): “WooCommerce Legacy REST API” – Version 1.0.5

Commerce APIs expose structured access to products, orders, customers, and store operations. A compatibility plugin that restores legacy endpoints must enforce authentication and permissions consistently across every request. WooCommerce Legacy REST API version 1.0.5 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64680, confirming that the plugin was reviewed from a secure code perspective with attention to API authentication, request authorization, object access, input parsing, response data, and legacy endpoint behavior.

Plugin Security Certification (PSC-2026-64679): “TranslatePress – Translate Multilingual sites with AI Translation” – Version 3.2.6

Plugin Security Certification (PSC-2026-64679): “TranslatePress – Translate Multilingual sites with AI Translation” – Version 3.2.6

Multilingual plugins store translated text and insert it into front-end output across themes and other plugins. Visual editing, language routing, and automatic translation features require firm access controls and consistent escaping. TranslatePress – Translate Multilingual sites with AI Translation version 3.2.6 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64679, confirming that the plugin was reviewed from a secure code perspective with attention to translation storage, visual editor permissions, multilingual routing, automatic translation settings, and public output.