CVE-2026-3985 affects Creative Mail <= 1.6.9 with unauthenticated time-based SQL injection in the abandoned checkout flow. A crafted checkout UUID reaches an unprepared SQL query and can be used to infer sensitive database data.
CVE-2025-15345 affects MapGeo – Interactive Geo Maps and is an unauthenticated reflected Cross-Site Scripting vulnerability in versions up to and including 1.6.27. When a public page uses the display-map shortcode in demo mode, an attacker can supply an external JavaScript URL through the map parameter and make the victim browser load it under the vulnerable site context.
CVE-2026-6229 affects Royal Addons for Elementor and is an authenticated Contributor+ server-side request forgery vulnerability in the Data Table widget. In versions through 1.7.1057, a user-controlled CSV URL can bypass the Google Sheets substring check, reach arbitrary internal or external HTTP services, and expose response data after it is parsed into the rendered table.
See how SC WordPress malware infects functions.php, db.php, and randomly named PHP loaders, and how CleanTalk detects and safely cures verified matches.
CVE-2025-11762 affects HubSpot All-In-One Marketing and exposes installed plugin names and versions to authenticated Contributor+ users through the global leadinConfig JavaScript object.
Most WordPress security scanners are good at catching malicious PHP code — web shells, injected theme and plugin files, suspicious eval() calls. But attackers have another tool in their arsenal: compiled binary files in ELF format (Executable and Linkable Format) — the standard executable format for Linux. Such a file contains no readable PHP code, doesn’t match familiar signatures found in plugin source files, and often has no file extension at all — so classic file scanners simply skip right past it.
This is exactly the gap that Security by CleanTalk’s new module — BinaryCheck — was built to close.
WordPress plugins that provide business directory functionality often allow administrators and editors to customize categories, icons, images, and other visual elements. While these features improve usability, they also increase the attack surface if user-controlled input is not properly validated before being stored and rendered.
During security testing of the GeoDirectory plugin, a Stored Cross-Site Scripting (Stored XSS) vulnerability was discovered affecting versions prior to 2.8.110. The vulnerability allows an authenticated Editor (or higher) to inject malicious JavaScript into the Map Icon parameter of a Place Category. The payload is permanently stored and later executed whenever the vulnerable page is viewed by another privileged user.
Because the malicious payload is stored inside the WordPress database, every administrator who accesses the affected interface can unknowingly execute attacker-controlled JavaScript, potentially resulting in complete administrative account compromise.
Charitable is a widely used WordPress donation and fundraising plugin that enables organizations to create fundraising campaigns, donation forms, recurring payment options, and crowdfunding initiatives. With its drag-and-drop campaign builder and customizable templates, it is trusted by thousands of nonprofits and charities to manage online donations.
During security testing, a Stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 1.8.5.3. The vulnerability exists in the campaign builder, where the ALT Text field for campaign images fails to properly sanitize user input before storing and rendering it. As a result, an authenticated administrator can inject malicious JavaScript that is permanently stored and executed whenever the vulnerable content is rendered.
WP2Shell is an actively exploited WordPress core RCE chain. See affected versions, code-level CVE analysis, IOCs, fixes, and CleanTalk protection.
Contact Form 7 extensions can influence spam checks, stored submissions, redirects, and outbound webhooks. These features cross the boundary between anonymous form input, privileged records, external destinations, and front-end responses. CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 version 3.6.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64684, confirming that the plugin was reviewed from a secure code perspective with attention to public submissions, anti-spam checks, stored records, redirect targets, webhook configuration, and administrator access.