Plugin Security Certification (PSC) by CleanTalk

Plugin Security Certification (PSC-2026-64605): “Translate WordPress with GTranslate” – Version 3.0.9

Translate WordPress with GTranslate (v3.0.9) is a multilingual WordPress solution that uses Google Translate automatic translation to make a site available in 103 languages, dramatically expanding reach to more than 99% of internet users. Since GTranslate has been providing website translation services since 2008, the plugin is built around a mature translation platform and a cloud-based approach that aims to keep the WordPress site fast—translations are delivered without heavy on-site processing. In paid editions, GTranslate adds full multilingual SEO capabilities (subdomains/subdirectories, indexable translations, translated metadata, hreflang, and more), helping websites grow international traffic and sales. Because translation plugins operate on nearly every frontend pageview, output user-visible content dynamically, and may modify SEO metadata and URL structures, security must be treated as a primary requirement. That’s why it’s important that GTranslate v3.0.9 has passed CleanTalk Plugin Security Certification (PSC-2026-64605), confirming the plugin was reviewed and validated against critical vulnerability classes and secure-coding expectations.

Plugin Security Certification (PSC-2026-64604): “Wordfence Security” – Version 8.1.4

Wordfence Security (v8.1.4) is one of the most widely deployed WordPress security plugins, combining an endpoint Web Application Firewall (WAF), malware scanning, login hardening (including 2FA), and centralized monitoring capabilities through Wordfence Central. Because a security plugin operates at the most sensitive layers of a WordPress site—authentication flows, request filtering, filesystem integrity checks, and threat detection—its own code integrity and safety are absolutely crucial. That’s why Wordfence Security v8.1.4 achieving CleanTalk Plugin Security Certification (PSC-2026-64604) matters: it indicates the plugin has been audited and validated to meet strong secure-coding expectations and to resist major exploit classes that commonly affect WordPress plugins.

CVE-2025-10583 – WP Fastest Cache – Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery – POC

CVE-2025-10583 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in the WordPress plugin WP Fastest Cache, affecting versions up to and including 1.7.4 according to the NVD record. What makes this issue especially operationally relevant is the plugin’s adoption: the WordPress.org listing shows 1+ million active installations, so any low-privilege-to-network-recon bug has immediate “real internet” consequences across a large attack surface. The core impact is not a direct data exfiltration primitive by itself, but rather a reliable way for a low-privileged authenticated user to coerce the server into making outbound connections, which can be weaponized for internal network discovery, firewall bypass, and chaining into higher-impact compromises.

Plugin Security Certification (PSC-2026-64603): “Google for WooCommerce” – Version 3.5.2

Google for WooCommerce (v3.5.2) is a commerce-focused extension that connects your WooCommerce store to Google’s ecosystem—most importantly Google Merchant Center, Google Ads (Performance Max), and Google tag / conversion tracking—so product data stays synchronized and campaigns can be launched and optimized from within WordPress. Because this plugin touches high-value surfaces (product feeds, pricing/inventory updates, ad attribution, and privacy-conscious conversion signals), security and data integrity are essential. That’s why it matters that Google for WooCommerce v3.5.2 has passed CleanTalk’s Plugin Security Certification (PSC-2026-64603), confirming the plugin was evaluated for secure coding practices and validated against a wide range of critical vulnerability classes.

Plugin Security Certification (PSC-2026-64602): “File Manager” – Version 8.0.2

File Manager (v8.0.2) is one of the most powerful WordPress file management plugins, enabling administrators to edit, upload, download, copy/move, rename, delete, archive/extract, and otherwise manage files and folders directly from the WordPress dashboard—reducing dependency on FTP or hosting control panels. Because

Plugin Security Certification (PSC-2026-64601): “Disable Gutenberg” – Version 3.3

Disable Gutenberg (v3.3) is a lightweight, highly configurable plugin that removes the Gutenberg/Block Editor and restores the classic WordPress editing experience (TinyMCE, meta boxes, custom fields, quicktags, and the original “Edit Post” screen). It’s widely used by site owners who rely on legacy workflows, Classic Editor-compatible extensions, or page builders like Elementor/Composer—and it does so without collecting user data, setting cookies, or calling third-party services. With Plugin Security Certification (PSC-2026-64601) by CleanTalk, Disable Gutenberg is now formally verified not only for performance and compatibility, but also for secure coding practices and resilience against modern WordPress plugin attack vectors.

CVE-2025-13891 – Image Gallery – Photo Grid & Video Gallery (Modula) – Authenticated Path Traversal / Directory Enumeration (via “file browser” AJAX) – POC

CVE-2025-13891 impacts the WordPress plugin Image Gallery – Photo Grid & Video Gallery (Modula) and is a path traversal / directory enumeration weakness in the plugin’s “file browser” AJAX functionality. The public CVE records describe that all versions up to and including 2.13.3 are affected, and that the vulnerable AJAX endpoint is modula_list_folders, which accepts a user-supplied directory path and fails to enforce a safe base directory restriction, enabling an authenticated user to enumerate arbitrary server directories.

CVE-2025-13922 – TaxoPress (Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI) – Authenticated (Contributor+) SQL Injection – POC

CVE-2025-13922 is an authenticated, time-based blind SQL injection affecting the WordPress plugin TaxoPress (plugin slug simple-tags). The issue sits in the TaxoPress AI preview feature and is triggered through an AJAX workflow, allowing a logged-in user with Contributor-level access (or higher) and AI metabox permissions to inject SQL into an ORDER BY clause, commonly demonstrated with delay payloads such as SLEEP() for observable timing impact. According to National Vulnerability Database, the vulnerable parameter is existing_terms_orderby, and the issue affects all versions up to and including 3.40.1. The plugin’s deployment footprint is significant – WordPress.org reports 50,000+ active installations – so even a “PR:L” authenticated SQLi matters in the real world where Contributor/Author accounts are common in editorial sites.

Plugin Security Certification (PSC-2026-64600): ” WP Armour – Honeypot Anti Spam” – Version 2.3.04: Use Anti-Spam Features with Enhanced Security

With Plugin Security Certification (PSC-2026-64600) from CleanTalk, WP Armour v2.3.04 has been formally validated for secure coding practices and resilience against major vulnerability classes. That matters because anti-spam plugins often hook into multiple sensitive areas (login, registration, comments, checkout) and operate on untrusted input at high volume. Certification confirms that WP Armour’s defenses don’t introduce new security risks.

Plugin Security Certification (PSC-2026-64599): “MC4WP: Mailchimp for WordPress” – Version 4.11.1: Use Newsletters with Enhanced Security

Email marketing remains one of the most effective and measurable growth channels for WordPress sites—whether you run an eCommerce store, a content site, a SaaS landing page, or a community. But newsletter plugins sit right on top of sensitive surfaces: public-facing forms, user identity fields, third-party API tokens, and deep integrations with checkout, registration, and contact systems. That combination makes security non-negotiable.
MC4WP: Mailchimp for WordPress (v4.11.1) is widely recognized as the #1 Mailchimp integration plugin for WordPress, providing flexible signup forms and broad compatibility with popular form and commerce plugins. With Plugin Security Certification (PSC-2026-64599) from CleanTalk, MC4WP is now formally validated for secure operation in real-world WordPress environments—especially important when handling subscriber data and Mailchimp connectivity.

« Previous