Plugin Security Certification (PSC) by CleanTalk

Plugin Security Certification (PSC-2026-64612): “ReCaptcha v2 for Contact Form 7” – Version 1.4.9

ReCaptcha v2 for Contact Form 7 is a lightweight compatibility plugin designed to bring back Google reCAPTCHA v2 support to Contact Form 7 after version 5.1 removed the [recaptcha] tag in December 2018. Instead of introducing custom implementations or external wrappers, the plugin restores the original functionality from Contact Form 7 v5.0.5, preserving the familiar behavior many site owners relied on.

CVE-2026-2687 – Reading progressbar – Stored XSS – POC

WordPress plugins that enhance user experience often expose administrative configuration fields that directly influence frontend rendering. When these fields are not properly sanitized, they can become a serious attack surface. CVE-2026-2687 affects the Reading Progressbar plugin, a lightweight tool that displays a reading progress indicator using an HTML5 element and JavaScript.

A stored Cross-Site Scripting (XSS) vulnerability was identified in the plugin’s settings panel, allowing an attacker to inject malicious JavaScript that is permanently stored and later executed in visitors’ or administrators’ browsers. This flaw can be leveraged to compromise administrator sessions, inject backdoors, or fully take over affected WordPress sites.

Major signs of Malware on an infected WordPress site

Hi guys, I’d like to share some significant signals that tell about infection on a WordPress site. These data has been collected by our research team at CleanTalk. The team reviews up to 10k files weekly as well as we

Plugin Security Certification (PSC-2026-64611): “Database Addon for Contact Form 7” – Version 1.3.5

Collecting form submissions is valuable, but storing them inside WordPress also creates a high value target because entries often include names, emails, phone numbers, messages, and sometimes sensitive business context. Database Addon for Contact Form 7 version 1.3.5 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64611, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for data capture and export plugins.

Plugin Security Certification (PSC-2026-64610): “GoSMTP” – Version 1.1.8

Email delivery is business critical, but email sending plugins also sit on a sensitive boundary where they handle SMTP credentials, API keys, admin side settings, and in some cases email logs that can contain personal data. GoSMTP version 1.1.8 has successfully completed the CleanTalk Plugin Security Certification program and received PSC-2026-64610, confirming that the plugin was assessed with a strong focus on secure coding practices and common real world WordPress attack paths.

Plugin Security Certification (PSC-2026-64609): “User Role Editor” – Version 4.64.6

User Role Editor v4.64.6 is a widely used WordPress administration plugin that lets site owners manage roles and capabilities through a clear checkbox based interface, making it easy to add, remove, clone, and delete roles while also supporting per user capability assignments and multisite networks. Because role and capability management directly governs access control across WordPress, any weakness in implementation could have severe impact, including unauthorized privilege changes or admin takeover paths. User Role Editor has passed CleanTalk Plugin Security Certification under PSC-2026-64609, confirming that the plugin was assessed for secure coding practices and validated against major vulnerability classes.

CVE-2025-14371 – TaxoPress – IDOR / Object‑Level Authorization Bypass to Modify Terms of Arbitrary Post – POC

CVE-2025-14371 affects TaxoPress and it breaks a core WordPress safety boundary where a user may have access to an editor feature but should not be able to change content they cannot edit. The vulnerability allows any authenticated user who is permitted to use the TaxoPress AI metabox, typically Contributor or Author and above, to add or remove tags on posts they do not own by supplying a victim post ID. This becomes a direct content integrity issue because tags and other taxonomy terms drive search relevance, internal navigation, feeds, and SEO surfaces, meaning a low privilege account can silently reshape how content is discovered even when the same user cannot open the post editor for the target post. Install base is significant at 50k plus, so multi author environments where Contributors exist are realistic targets rather than edge cases.

CVE-2025-14163 – Premium Addons for Elementor – CSRF on Elementor Template Creation – POC

CVE-2025-14163 is a Cross Site Request Forgery weakness in Premium Addons for Elementor that turns a normal authenticated workflow into a silent action a victim performs on an attacker’s behalf. The core problem is simple but dangerous in real operations a logged in user can be tricked into creating a new Elementor template without clicking anything and without seeing a warning, because the plugin’s AJAX action accepts a state changing request that lacks any CSRF protection. Even though the action requires a user who has edit_posts, that still covers a wide range of common roles on real sites such as Author and Editor, which means this is not limited to administrators and can be triggered against typical editorial staff who routinely browse the web while logged in.

Plugin Security Certification (PSC-2026-64608): “Post Types Order” – Version 2.4.3

Post Types Order v2.4.3 is a widely adopted WordPress plugin with over 12 million downloads that gives site owners precise control over how posts and custom post types are ordered using a clean drag and drop workflow inside WordPress. Because ordering affects query behavior and admin interfaces, a plugin like this sits close to core content retrieval and display logic, which makes secure implementation essential. Post Types Order has passed CleanTalk Plugin Security Certification under PSC-2026-64608, confirming that the plugin was assessed for secure coding practices and validated against major vulnerability classes.

CVE-2025-14155 – Premium Addons for Elementor – Unauthenticated Sensitive Data Disclosure – POC

CVE-2025-14155 is an unauthenticated information disclosure vulnerability in Premium Addons for Elementor – Powerful Elementor Templates & Widgets, where an external attacker can retrieve the rendered HTML of Elementor templates that were never meant to be publicly readable. The National Vulnerability Database (NVD) describes the root cause as a missing capability check in the plugin’s get_template_content function, enabling unauthenticated attackers to view the contents of private, draft, and pending templates in all versions up to and including 4.11.53. This matters in real deployments because Elementor templates often contain unpublished landing pages, internal copy, experiment variants, marketing plans, gated offers, or “coming soon” pages that site owners assume are only visible inside the editor/dashboard until explicitly published or embedded.

« Previous