Plugin Security Certification (PSC-2026-64689): “WebP Express” – Version 0.25.15

Plugin Security Certification (PSC-2026-64689): “WebP Express” – Version 0.25.15

Image conversion plugins process uploaded files, write derivatives, update rewrite rules, and may invoke local or remote converters. WebP Express version 0.25.15 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64689, confirming that the review focused on file access, conversion inputs, generated output paths, rewrite behavior, converter configuration, and protection of privileged settings.

Plugin Security Certification (PSC-2026-64688): “Admin Menu Editor” – Version 1.15.2

Plugin Security Certification (PSC-2026-64688): “Admin Menu Editor” – Version 1.15.2

Dashboard customization tools influence navigation, capability checks, menu visibility, redirects, and access to administrative screens. Admin Menu Editor version 1.15.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64688, confirming that the review focused on settings authorization, capability handling, menu configuration integrity, redirect behavior, and safe processing of custom labels, URLs, and icons.

Plugin Security Certification (PSC-2026-64687): “Breeze Cache” – Version 2.5.13

Plugin Security Certification (PSC-2026-64687): “Breeze Cache” – Version 2.5.13

Caching and optimization plugins rewrite responses, manage cache files, and interact with CDNs and remote asset sources. Breeze Cache version 2.5.13 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64687, confirming that the review focused on cache storage, purge operations, optimization settings, remote downloads, administrator controls, and safe handling of generated assets.

Plugin Security Certification (PSC-2026-64686): “Disable Comments – Remove Comments & Stop Spam [Multi-Site Support]” – Version 2.8.0

Plugin Security Certification (PSC-2026-64686): “Disable Comments – Remove Comments & Stop Spam [Multi-Site Support]” – Version 2.8.0

Comment management tools affect public submission paths, administration screens, feeds, APIs, and multisite policy. Disable Comments – Remove Comments & Stop Spam [Multi-Site Support] version 2.8.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64686, confirming that the review focused on settings access, request validation, comment-related endpoints, role-aware controls, and consistent enforcement across supported site contexts.

Plugin Security Certification (PSC-2026-64685): “Site Kit by Google – Analytics, Search Console, AdSense, Speed” – Version 1.186.0

Plugin Security Certification (PSC-2026-64685): “Site Kit by Google – Analytics, Search Console, AdSense, Speed” – Version 1.186.0

Analytics and advertising integrations connect a WordPress dashboard to external services and expose site performance data to privileged users. Site Kit by Google – Analytics, Search Console, AdSense, Speed version 1.186.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64685, confirming that the review focused on service connections, dashboard data access, REST requests, administrator actions, and safe rendering of remote metrics.

CVE-2026-9125 – Presto Player – Contributor+ Stored XSS – POC

CVE-2026-9125 – Presto Player – Contributor+ Stored XSS – POC

CVE-2026-9125 affects Presto Player and is an authenticated Contributor+ Stored Cross-Site Scripting vulnerability in versions up to and including 4.2.0. A malicious presto_player_overlay shortcode can preserve a javascript: URI in link_url, allowing attacker-controlled JavaScript to run in the WordPress origin when another user clicks the overlay during playback.

CVE-2025-15345 – MapGeo – Unauth Reflected XSS – POC

CVE-2025-15345 – MapGeo – Unauth Reflected XSS – POC

CVE-2025-15345 affects MapGeo – Interactive Geo Maps and is an unauthenticated reflected Cross-Site Scripting vulnerability in versions up to and including 1.6.27. When a public page uses the display-map shortcode in demo mode, an attacker can supply an external JavaScript URL through the map parameter and make the victim browser load it under the vulnerable site context.