CVE-2025-15693: an Admin+ Path Traversal in the JCH Optimize WordPress plugin (4.2.1–5.0.0), reachable through the dir parameter of the filetree AJAX action. Details, timeline, PoC and remediation.
CVE-2025-15694: an Admin+ Stored XSS in the Joli Table Of Contents WordPress plugin (2.0.0–2.8.0), triggered through the headings_overflow setting on the plugin’s General tab. Details, timeline, PoC and remediation.
CVE-2025-15663: an Author+ Stored XSS in the BEAF (Ultimate Before After Image Slider & Gallery) WordPress plugin below 4.7.19, triggered through the slider’s After Label field. Details, timeline, PoC and remediation.
How to filter unwanted traffic on WordPress with the Security FireWall, Web Application Firewall and Traffic Control modules of Security by CleanTalk — blocking by IP, network and country, rate limiting, CDN setup, and how the alternatives compare.
A stolen or guessed password should not be enough to take over your website — yet for most WordPress sites it is. Brute-force bots hammer /wp-login.php around the clock, and credential leaks from unrelated services are replayed against admin accounts every day. Two-Factor
Most WordPress security scanners are good at catching malicious PHP code — web shells, injected theme and plugin files, suspicious eval() calls. But attackers have another tool in their arsenal: compiled binary files in ELF format (Executable and Linkable Format) — the standard executable format for Linux. Such a file contains no readable PHP code, doesn’t match familiar signatures found in plugin source files, and often has no file extension at all — so classic file scanners simply skip right past it.
This is exactly the gap that Security by CleanTalk’s new module — BinaryCheck — was built to close.
WordPress plugins that provide business directory functionality often allow administrators and editors to customize categories, icons, images, and other visual elements. While these features improve usability, they also increase the attack surface if user-controlled input is not properly validated before being stored and rendered.
During security testing of the GeoDirectory plugin, a Stored Cross-Site Scripting (Stored XSS) vulnerability was discovered affecting versions prior to 2.8.110. The vulnerability allows an authenticated Editor (or higher) to inject malicious JavaScript into the Map Icon parameter of a Place Category. The payload is permanently stored and later executed whenever the vulnerable page is viewed by another privileged user.
Because the malicious payload is stored inside the WordPress database, every administrator who accesses the affected interface can unknowingly execute attacker-controlled JavaScript, potentially resulting in complete administrative account compromise.
Charitable is a widely used WordPress donation and fundraising plugin that enables organizations to create fundraising campaigns, donation forms, recurring payment options, and crowdfunding initiatives. With its drag-and-drop campaign builder and customizable templates, it is trusted by thousands of nonprofits and charities to manage online donations.
During security testing, a Stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 1.8.5.3. The vulnerability exists in the campaign builder, where the ALT Text field for campaign images fails to properly sanitize user input before storing and rendering it. As a result, an authenticated administrator can inject malicious JavaScript that is permanently stored and executed whenever the vulnerable content is rendered.
Overview As part of our regular security review process, several potential security issues were identified in the CleanTalk Anti-Spam module for 1C-Bitrix. The reported issues included: All reported issues were reviewed by our development and security teams. Confirmed vulnerabilities have
Every day, thousands of WordPress websites become targets for cybercriminals. Vulnerable plugins, outdated themes, weak passwords, and newly discovered security flaws allow attackers to upload malicious code, web shells, SEO spam, backdoors, and other dangerous files.
In many cases, website owners are completely unaware that their site has been compromised. Malware can remain active for weeks or even months while secretly redirecting visitors, sending spam, creating hidden administrator accounts, or providing attackers with full control over the server.