Author: Artyom Krugov

Plugin Security Certification (PSC-2026-65699): “Meta Box – A Framework for Dynamic Websites” – Version 5.15.1

Custom fields frameworks render administrator-defined fields on post, term, user, and settings screens, store arbitrary meta, and expose AJAX endpoints for selecting posts, users, and terms, uploading and deleting files, and fetching oEmbeds. Meta Box – A Framework for Dynamic Websites version 5.15.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65699. The review focused on AJAX authorization and nonces, the file upload and delete flow, object-selection endpoints, meta storage and output escaping, and the [rwmb_meta] shortcode.

Plugin Security Certification (PSC-2026-65698): “Web Accessibility (formally known as Ally) – WCAG Scanning, Guided Fixes, Usability Widget” – Version 4.1.4

Accessibility widgets combine public front-end output with administrator-managed settings, on-page WCAG scanning, and guided fixes that change how content is presented to visitors. Web Accessibility (formally known as Ally) – WCAG Scanning, Guided Fixes, Usability Widget version 4.1.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65698. The review focused on REST API authorization, the public analytics endpoint, scan and remediation data handling, SVG icon uploads, and safe rendering of administrator-controlled widget settings.

Plugin Security Certification (PSC-2026-64695): “Drag and Drop Multiple File Upload for Contact Form 7” – Version 1.4.0

File upload add-ons for Contact Form 7 receive untrusted files from anonymous website visitors, write them into the WordPress uploads directory, and expose AJAX endpoints for uploading and deleting those files. Drag and Drop Multiple File Upload for Contact Form 7 version 1.4.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64695, confirming that the review focused on unauthenticated AJAX upload handling, file-extension and MIME validation, filename sanitization and anti-script renaming, upload-path confinement, token-based file-deletion authorization, request rate limiting, and output escaping in the settings screen.

CVE-2025-15693 – JCH Optimize – Path Traversal via the filetree dir Parameter – PoC

CVE-2025-15693: an Admin+ Path Traversal in the JCH Optimize WordPress plugin (4.2.1–5.0.0), reachable through the dir parameter of the filetree AJAX action. Details, timeline, PoC and remediation.

CVE-2025-15694 – Joli Table Of Contents – Stored XSS – PoC

CVE-2025-15694: an Admin+ Stored XSS in the Joli Table Of Contents WordPress plugin (2.0.0–2.8.0), triggered through the headings_overflow setting on the plugin’s General tab. Details, timeline, PoC and remediation.

CVE-2025-15663 – Ultimate Before After Image Slider & Gallery (BEAF) – Author+ Stored XSS via After Label – PoC

CVE-2025-15663: an Author+ Stored XSS in the BEAF (Ultimate Before After Image Slider & Gallery) WordPress plugin below 4.7.19, triggered through the slider’s After Label field. Details, timeline, PoC and remediation.

WordPress Firewall Plugin: How to Block IPs, Countries and Bot Floods with Security by CleanTalk

How to filter unwanted traffic on WordPress with the Security FireWall, Web Application Firewall and Traffic Control modules of Security by CleanTalk — blocking by IP, network and country, rate limiting, CDN setup, and how the alternatives compare.

Two-Factor Authentication for WordPress: Why 2FA Matters and How to Enable It

A stolen or guessed password should not be enough to take over your website — yet for most WordPress sites it is. Brute-force bots hammer /wp-login.php around the clock, and credential leaks from unrelated services are replayed against admin accounts every day. Two-Factor

How to Find and Remove Malicious ELF Files on Your Website: CleanTalk’s BinaryCheck Module

Most WordPress security scanners are good at catching malicious PHP code — web shells, injected theme and plugin files, suspicious eval() calls. But attackers have another tool in their arsenal: compiled binary files in ELF format (Executable and Linkable Format) — the standard executable format for Linux. Such a file contains no readable PHP code, doesn’t match familiar signatures found in plugin source files, and often has no file extension at all — so classic file scanners simply skip right past it.

This is exactly the gap that Security by CleanTalk’s new module — BinaryCheck — was built to close.

CVE-2025-15677 – GeoDirectory < 2.8.110 – Editor+ Stored XSS – POC

WordPress plugins that provide business directory functionality often allow administrators and editors to customize categories, icons, images, and other visual elements. While these features improve usability, they also increase the attack surface if user-controlled input is not properly validated before being stored and rendered.

During security testing of the GeoDirectory plugin, a Stored Cross-Site Scripting (Stored XSS) vulnerability was discovered affecting versions prior to 2.8.110. The vulnerability allows an authenticated Editor (or higher) to inject malicious JavaScript into the Map Icon parameter of a Place Category. The payload is permanently stored and later executed whenever the vulnerable page is viewed by another privileged user.

Because the malicious payload is stored inside the WordPress database, every administrator who accesses the affected interface can unknowingly execute attacker-controlled JavaScript, potentially resulting in complete administrative account compromise.