Plugin Security Certification (PSC) by CleanTalk

The Structured Content plugin helps WordPress users enhance their pages with rich JSON-LD schema.org structured data elements. It allows for the insertion of components like FAQs, job postings, events, and more, with options to display the content as visible HTML or hidden machine-readable data.

However, in version 1.6.4 and below, a Stored Cross-Site Scripting (XSS) vulnerability was identified that allows users with Contributor privileges to inject malicious JavaScript via the “Additional CSS class(es)” field in FAQ blocks. This XSS payload is then persistently stored and can be executed when the HTML is rendered, leading to account compromise or further exploitation.

The OpenStreetMap for Gutenberg and WPBakery Page Builder plugin is designed to help WordPress users easily embed customizable and interactive maps into their posts and pages. However, in version 1.2.0 and below, a Stored Cross-Site Scripting (XSS) vulnerability exists, which allows Contributor-level users to inject persistent JavaScript code into map marker popup text. This can lead to account compromise, content injection, and potentially full site takeover.

Calculated Fields Form is a versatile WordPress plugin that lets users design dynamic forms with live calculations, sliders, and conditional logic. With more than 60,000 active installations, it powers everything from loan calculators to interactive quizzes. However, a severe security flaw—CVE-2024-13381—has been discovered in the plugin’s Slider block configuration. This vulnerability allows an editor to inject persistent JavaScript into form captions, which executes whenever the form is previewed, creating an avenue for backdoor creation and full administrative takeover.

Sure Forms is a popular WordPress plugin with over 200,000 active installations, enabling site owners to create custom contact forms, surveys, and interactive interfaces. While robust in features and ease of use, a critical vulnerability—CVE-2025-5921—has been discovered that permits unauthenticated visitors to execute Cross‑Site Scripting (XSS). By crafting a special URL parameter, attackers can embed JavaScript into a public form field, triggering scripts in an administrator’s browser and forging a path to a persistent backdoor or account takeover.

Form Maker by 10Web is a popular WordPress plugin that enables site owners to build custom forms with drag-and-drop ease. Boasting over 50,000 active installations, it powers everything from simple contact forms to complex multi-step surveys. Despite its robust feature set, including advanced validation and styling options, the plugin contains a critical security flaw—CVE-2024-6130—that allows an editor to inject malicious JavaScript via the form field “classname” attribute. Once stored, this payload executes whenever the form is rendered, enabling account takeover, backdoor installation, and broader site compromise.

The Newsletter plugin is a cornerstone of email marketing for WordPress, with over 300,000 active installations. It allows site owners to embed subscription forms via shortcodes and widgets, manage subscriber lists, and send targeted campaigns. Yet, a critical security flaw—CVE-2025-3581—has been discovered within its widget configuration. This vulnerability permits a user with Editor privileges to inject malicious JavaScript into the widget’s Title field. As a result, any visitor or administrator viewing the widget on the frontend will execute the stored script, potentially establishing a persistent backdoor and complete site compromise.

The Newsletter plugin remains one of the most installed WordPress subscription solutions, with over 300,000 installations powering email campaigns and subscription forms worldwide. Despite its robust feature set—such as drag-and-drop form creation and subscriber management—a severe security flaw has been identified: CVE-2025-3582. This vulnerability allows a user with Editor-level privileges to inject persistent JavaScript into the form configuration itself. Once embedded, the malicious code will execute in any administrator’s or visitor’s browser when they view the affected form, providing attackers with a potent avenue to create backdoors and take over accounts.