WP SiteGround Control malware hides in MU-plugins and delivers remote SEO spam. Learn how it persists, what to look for and how to remove it.
Fake WP SiteGround Control Malware Hides in MU-Plugins
CVE-2026-112243 - Duplicator - Unauth Reflected XSS - POC
CVE-2026-112243 is a Reflected Cross-Site Scripting vulnerability in the Duplicator WordPress migration and backup plugin before version 5.1.0. An unauthenticated attacker can place HTML in the logname query parameter and send the link to an Administrator who can access Duplicator Tools. When the log list is empty, opening the link can execute JavaScript in that administrator’s browser session. The supplied test reproduced the issue on version 5.0.6. The vulnerability is fixed in 5.1.0.
UpdraftCentral Malware and WordPress Login Backdoors
Site Tools 2366 and Defer Helper could grant administrator access through WordPress authentication APIs. Logs traced their installation to UpdraftCentral. The case explains infection evidence, backdoor behavior and recovery.
CVE-2025-15669 - Bit Form - Admin+ Stored XSS - POC
CVE-2025-15669 is a stored Cross-Site Scripting vulnerability in the Bit Form WordPress plugin before version 3.1.4. A user with permission to manage the plugin can store script content in a conversational form setting. The content can run in a visitor’s browser and may lead to unauthorized actions or compromise of an administrator account. Version 2.19.1 was used during testing.
PHP2Shell and WordPress: What CVE-2026-109618 and CVE-2026-109619 Mean for Your Site
PHP2Shell (CVE-2026-109618, CVE-2026-109619) is a critical, exploited RCE in the PHP engine. How critical it is for WordPress sites, who is exposed, how to check your PHP version, and what to do.
CVE-2025-15703 – WP Job Openings – Admin+ Stored XSS – POC
CVE-2025-15703: an Admin+ Stored XSS in the WP Job Openings WordPress plugin (below 4.0.0), triggered through the Icon field of a job specification. Details, timeline, PoC and remediation.
Plugin Security Certification (PSC-2026-65720): “Show Current Template” – Version 0.5.4
Template diagnostics expose theme and file information in the WordPress toolbar to help explain how a page was rendered. Show Current Template version 0.5.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65720. The review focused on toolbar visibility, user access, template and theme names, included file output, and escaping of diagnostic information.
Plugin Security Certification (PSC-2026-65719): “Simple 301 Redirects by BetterLinks – Easy Redirect Manager” – Version 2.1.2
Redirect managers control how incoming URLs are routed and can change the destination of existing site traffic. Simple 301 Redirects by BetterLinks – Easy Redirect Manager version 2.1.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65719. The review focused on redirect management permissions, source and destination validation, wildcard rules, bulk import and export, and dashboard output.
Plugin Security Certification (PSC-2026-65718): “IndexNow Plugin” – Version 1.0.4
Search notification plugins transmit site URLs to indexing services when content is created, updated, or removed. IndexNow Plugin version 1.0.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65718. The review focused on submission permissions, API key handling, automatic publishing events, URL exclusions, manual requests, submission history, and external communication.
Plugin Security Certification (PSC-2026-65717): “SSL Insecure Content Fixer” – Version 2.7.2
Mixed content correction changes resource URLs and page output so an HTTPS site can load its assets consistently. SSL Insecure Content Fixer version 2.7.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65717. The review focused on administrative settings, correction levels, HTTPS detection, content rewriting, multisite defaults, and safe output handling.