Author: Artyom Krugov

CVE-2024-13729 – Podlove Podcast Publisher < 4.1.24 – Stored XSS to Admin Creation – POC

Podlove Podcast Publisher is a powerful WordPress plugin designed to streamline podcast publishing. It offers features like multi-format publishing, enhanced RSS feeds, an optimized web player, and metadata management. However, a critical stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-13729) has been identified in versions prior to 4.1.24, allowing attackers to inject malicious scripts that could lead to unauthorized administrative actions

CVE-2024-12716 – Simple Basic Contact Form – Stored XSS to Admin Creation – POC

The Simple Basic Contact Form (SBCF) plugin is widely used in WordPress for implementing lightweight and efficient contact forms. Despite its focus on security and minimalism, a Stored Cross-Site Scripting (XSS) vulnerability has been identified, allowing an attacker to inject malicious scripts that execute in the browser of an administrator. This article explores the discovery, exploitation, and security implications of this vulnerability while providing recommendations for mitigation.

CVE-2024-12679 – Prisna GWT for WordPress – Stored XSS to JS Backdoor Creation – POC

WordPress is one of the most popular content management systems, powering millions of websites worldwide. Plugins enhance its functionality but can also introduce security vulnerabilities. One such case is the Prisna GWT plugin, which allows automatic translation using Google’s services. A stored cross-site scripting (XSS) vulnerability (CVE-2024-12679) has been identified in this plugin, posing a risk to website security. This article explores the discovery, exploitation, and mitigation of this vulnerability.

Plugin Security Certification (PSC-2025-64561): “Fluent Forms PRO” – Version 6.0.1: Use Forms with Enhanced Security

Fluent Forms PRO, like Fluent Forms, has passed a thorough security assessment and received the Plugin Security Certification (PSC) from CleanTalk, which guarantees users a secure environment for managing forms.
Fluent Forms PRO is a comprehensive and secure contact form builder with advanced features developed for WordPress. With an intuitive, drag-and-drop interface, Fluent Forms provides a wide range of features that are suitable for both beginners and advanced users. Recognized for its performance, Fluent Forms loads quickly without overloading your website and offers a wide range of powerful form functionality. The plugin’s security features protect user data, and advanced customization options make it a universal choice for any WordPress website.

And now, thanks to the security certification of the plugin (PSC-2024-64561) from CleanTalk, you can use Fluent Forms with a guarantee of increased security. This certification confirms that Fluent Forms has passed a thorough security check, making it a reliable means of managing the contact form builder without introducing vulnerabilities to your WordPress site.

CVE-2024-13616 – Vik Booking for WordPress – Stored XSS to JS Backdoor Creation – POC

WordPress remains one of the most popular content management systems (CMS) worldwide, offering thousands of plugins to enhance its functionality. However, the security of these plugins is a significant concern, as vulnerabilities can expose websites to attacks. One such vulnerability, CVE-2024-13616, was discovered in the Vik Booking plugin, a popular hotel booking engine for WordPress. This article explores the discovery, exploitation, and potential risks of this stored XSS vulnerability, along with recommendations for mitigation.

CVE-2024-13383 – HD Quiz < 2.0.0 – Stored XSS to JS Backdoor Creation – POC

In modern web development, security vulnerabilities remain a critical concern, particularly when user-generated content is involved. One such vulnerability, CVE-2024-13383, was identified in the HD Quiz plugin (versions prior to 2.0.0) for WordPress. This vulnerability allows an attacker to inject stored cross-site scripting (XSS) payloads into quizzes, leading to potential exploitation and compromise of user data.

CVE-2024-12739 – Mobile Contact Bar < 3.0.5 – Stored XSS to JS Backdoor Creation – POC

The Mobile Contact Bar plugin for WordPress provides website owners with an intuitive way to create customizable contact options for their visitors. However, a critical Stored Cross-Site Scripting (XSS) vulnerability has been identified in versions below 3.0.5, which can lead to JavaScript backdoor creation and potential full site compromise. This article explores the discovery, exploitation, risks, and mitigation strategies for this vulnerability

CVE-2024-11503 – WP Tabs < 2.2.7 – Stored XSS to JS Backdoor Creation – POC

WP Tabs is a widely used WordPress plugin designed to help users create and manage tabbed navigation on their websites. With its user-friendly interface and extensive customization options, WP Tabs has gained popularity among WordPress site owners. However, a security vulnerability (CVE-2024-111503) was discovered in versions below 2.2.7, exposing websites to a Stored Cross-Site Scripting (XSS) attack. This article delves into the discovery, exploitation, risks, and remediation of this vulnerability.

Plugin Security Certification (PSC-2025-64560): “Disable Comments – Remove Comments & Stop Spam” – Version 2.4.7: Use Comments plugin with Enhanced Security

Disable Comments – Remove Comments & Stop Spam [Multi-Site Support] is a powerful plugin designed to give WordPress site owners complete control over comment functionality. By allowing users to globally enable or disable comments on posts, pages, and media, this plugin is an effective tool to prevent spam and unwanted discussions. It provides seamless integration with WP-CLI, XML-RPC, and REST-API, ensuring a streamlined approach to managing comments.

This plugin enhances website security by eliminating potential spam injection points and preventing unauthorized comment-based interactions. It has successfully undergone rigorous security testing and has received the prestigious Plugin Security Certification (PSC-2025-64560) from CleanTalk, ensuring robust protection against spam-related vulnerabilities.

CVE-2024-10475 – Lead Form Builder – Stored XSS to JS Backdoor Creation – POC

Lead Form Builder is a popular WordPress plugin designed to create and manage contact forms. It offers an easy-to-use drag-and-drop interface and integration with page builders like Elementor, Brizy, SiteOrigin, and Gutenberg. However, a security vulnerability (CVE-2024-10475) was discovered in versions prior to 1.9.8, which allows attackers to inject and execute malicious JavaScript code through Stored Cross-Site Scripting (XSS). This article explores the vulnerability, its risks, exploitation, and best practices to mitigate the issue.