Author: Artyom Krugov

CVE-2025-15675 – Charitable < 1.8.5.3 – Admin+ Stored XSS – POC

Charitable is a widely used WordPress donation and fundraising plugin that enables organizations to create fundraising campaigns, donation forms, recurring payment options, and crowdfunding initiatives. With its drag-and-drop campaign builder and customizable templates, it is trusted by thousands of nonprofits and charities to manage online donations.

During security testing, a Stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 1.8.5.3. The vulnerability exists in the campaign builder, where the ALT Text field for campaign images fails to properly sanitize user input before storing and rendering it. As a result, an authenticated administrator can inject malicious JavaScript that is permanently stored and executed whenever the vulnerable content is rendered.

Security Update for CleanTalk Anti-Spam Module for 1C-Bitrix

Overview As part of our regular security review process, several potential security issues were identified in the CleanTalk Anti-Spam module for 1C-Bitrix. The reported issues included: All reported issues were reviewed by our development and security teams. Confirmed vulnerabilities have

How Security by CleanTalk Protects WordPress Websites with Signature Analysis and Cloud Malware Detection

Every day, thousands of WordPress websites become targets for cybercriminals. Vulnerable plugins, outdated themes, weak passwords, and newly discovered security flaws allow attackers to upload malicious code, web shells, SEO spam, backdoors, and other dangerous files.

In many cases, website owners are completely unaware that their site has been compromised. Malware can remain active for weeks or even months while secretly redirecting visitors, sending spam, creating hidden administrator accounts, or providing attackers with full control over the server.

Plugin Security Certification (PSC-2026-64664): “Kadence Blocks — Page Builder Toolkit for Gutenberg Editor” – Version 4.1.9

Kadence Blocks is a powerful extension for the native WordPress block editor, designed to provide advanced Gutenberg blocks, responsive layout controls, dynamic design tools, and professional website-building functionality without requiring custom code.

The plugin extends WordPress with a wide collection of custom blocks including Accordions, Advanced Buttons, Forms, Galleries, Tabs, Testimonials, Post Grids, Row Layouts, Progress Bars, Lottie Animations, and many more. It is optimized for performance, accessibility, and scalability while maintaining clean frontend output and modern design standards.

Plugin Security Certification (PSC-2026-64655): “Royal Addons for Elementor – Advanced Elementor Addons & Templates Kit Security Review” – Version 1.7.1062

Royal Addons for Elementor – Addons and Templates Kit for Elementor is a comprehensive extension for the Elementor page builder, designed to help WordPress users create advanced websites without writing code. The plugin provides more than 100 Elementor widgets, 150+ template kits, WooCommerce builders, mega menu builders, AJAX search functionality, conditional visibility logic, popup builders, advanced filters, sliders, carousels, and many other frontend customization tools.

CVE-2026-6495 – Ajax Load More < 7.8.4 – Reflected XSS – POC

Ajax Load More is a popular WordPress plugin used for implementing infinite scroll, lazy loading, and dynamic content loading via AJAX. It allows developers to build flexible queries and display posts without reloading the page. During security testing, a Reflected

Plugin Security Certification (PSC-2026-64645): “Forminator Forms – Contact Form, Payment Form & Custom Form Builder” – Version 8.6.0

Forminator Forms – Contact Form, Payment Form & Custom Form Builder (v1.53.1) is a multifunctional WordPress plugin that enables the creation of forms, polls, quizzes, payment forms, and lead-generation tools through a drag-and-drop interface. It integrates with payment gateways, CRMs, and third-party services, making it a high-impact component in the application security surface.

Built for websites running on WordPress, Forminator handles sensitive user data, payments, file uploads, and AJAX interactions — making security a critical requirement.

The plugin functionality includes payments (Stripe, PayPal), quizzes, surveys, integrations, and GDPR-ready data handling

Plugin Security Certification (PSC-2026-64643): “Bug reporting tool & Website feedback. Spotfix” – Version 1.0.4

Bug reporting tool & Website feedback – Spotfix (v1.0.4) is a lightweight WordPress plugin that enables users to submit contextual feedback directly on website pages. By allowing visitors to highlight specific elements and attach comments (“Spots”), the plugin transforms feedback into structured, actionable tasks.

Designed for websites running on WordPress, Spotfix integrates frontend interaction with backend task management via external services, enabling teams to track and resolve issues efficiently.

Because the plugin processes user-generated content, interacts with external APIs, and injects frontend JavaScript widgets, a comprehensive security audit was conducted.

Plugin Security Certification (PSC-2026-64642): “MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor” – Version 4.1.3

MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (v4.1.3) is a powerful drag-and-drop form builder plugin designed to extend Elementor with advanced form creation capabilities. It allows users to build complex forms such as contact forms, surveys, booking forms, payment forms, and more without writing code.

Built for websites running on WordPress, MetForm integrates deeply into both frontend and backend workflows, handling user input, data storage, AJAX submissions, file uploads, and third-party integrations.

With over 600,000+ active installations, the plugin operates in a highly sensitive layer of application logic, making security a critical factor. A comprehensive source-code audit was conducted to evaluate its safety.

Plugin Security Certification (PSC-2026-64637): “MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites” – Version 6.0.5

MainWP Child – Securely Connects to the MainWP Dashboard (v6.0.5) is a WordPress plugin designed to establish a secure connection between individual WordPress sites and a self-hosted MainWP Dashboard. This architecture allows centralized management of multiple websites, including updates, backups, monitoring, and content administration.

Built for websites running on WordPress, the plugin acts as a controlled communication bridge between managed sites and the MainWP Dashboard.

Due to its role in remote management and cross-site communication, MainWP Child operates in a highly sensitive security context. As a result, a comprehensive security audit of its codebase and communication mechanisms was conducted.