Security Archives - Page 2 of 64 - Plugin Security Certification (PSC) by CleanTalk

Plugin Security Certification (PSC-2026-64665): “Jetpack – WP Security, Backup, Speed, and Growth” – Version 15.9.1

Security and performance suites operate across many areas of a WordPress installation, including backups, malware scanning, content delivery, statistics, forms, and social publishing. That makes them operationally useful, but also security-sensitive because a broad plugin footprint can affect privileged settings, connected service tokens, public scripts, and administrator workflows. Jetpack – WP Security, Backup, Speed, and Growth version 15.9.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64665, confirming that the plugin was reviewed from a secure code perspective with attention to common exploitation paths for security suites, backup workflows, performance modules, and connected service integrations.

How Security by CleanTalk Blocks Brute Force Login Attempts in WordPress

Security by CleanTalk Brute Force Protection editorial illustration with compact login and attempt cards

A real WordPress test shows how Security by CleanTalk Brute Force Protection records repeated invalid passwords, blocks the visitor, and gives administrators a clear Security Log trail.

CVE-2026-2918 – Happy Addons – Stored XSS – POC

CVE-2026-2918 affects Happy Addons for Elementor and it is an authenticated Contributor level stored cross site scripting vulnerability in the Theme Builder Template Conditions workflow. The vulnerable AJAX action accepts an arbitrary template_id and performs a broad edit_posts capability check instead of checking the specific ha_library template. A Contributor with access to the Elementor editor nonce can change conditions for another published template and store crafted condition data that is later rendered as unsafe HTML attributes in the Elementor editor. When an administrator opens Template Conditions, the payload can run in the admin browser context, which can lead to nonce theft, privileged actions, and full site compromise.

Security Update for CleanTalk Anti-Spam Module for 1C-Bitrix

Overview As part of our regular security review process, several potential security issues were identified in the CleanTalk Anti-Spam module for 1C-Bitrix. The reported issues included: All reported issues were reviewed by our development and security teams. Confirmed vulnerabilities have

How Security by CleanTalk Helps Stop WordPress Login Discovery

Security by CleanTalk login discovery guard dashboard illustration

Security by CleanTalk helps WordPress sites reduce login discovery by protecting author archive redirects, password reset responses, and the REST API users endpoint.

CVE-2026-8438 – All-In-One Security – Stored XSS – POC

CVE-2026-8438 affects All-In-One Security (AIOS) – Security and Firewall and it is an unauthenticated stored cross site scripting vulnerability in the debug log workflow. When debug mode and the REST API restriction for non-logged in users are enabled, an attacker can place HTML or JavaScript in the REST request path. The decoded path is written into the debug log and later rendered without escaping in the AIOS Dashboard Debug logs page. A single request can therefore plant script that runs in an administrator browser session when the log view is opened, which can lead to nonce theft, privileged actions, and full site compromise.

How Security by CleanTalk Password Leak Check Stops a Weak WordPress Admin Password

Security by CleanTalk protects a WordPress administrator login from leaked passwords

A practical review of Security by CleanTalk Password Leak Check using a test WordPress administrator with the exposed password qwerty. The feature detected the leaked credential, marked the account as risky, and forced password replacement before the administrator could continue working in wp-admin.

How Security by CleanTalk Protects WordPress Websites with Signature Analysis and Cloud Malware Detection

Every day, thousands of WordPress websites become targets for cybercriminals. Vulnerable plugins, outdated themes, weak passwords, and newly discovered security flaws allow attackers to upload malicious code, web shells, SEO spam, backdoors, and other dangerous files.

In many cases, website owners are completely unaware that their site has been compromised. Malware can remain active for weeks or even months while secretly redirecting visitors, sending spam, creating hidden administrator accounts, or providing attackers with full control over the server.

CVE-2026-0722 – Shield Security – CSRF to SQLi – POC

CVE-2026-0722 affects Shield Security and covers a CSRF bypass that can be chained into SQL injection in versions up to and including 21.0.8. The vulnerable AJAX flow can be reached through wp-admin/admin-ajax.php with action=shield_action and ex=traffictable_action, where a forged request can disable nonce verification through action_overrides[is_nonce_verify_required]=0.

CVE-2026-0561 – Shield Security – Unauth Reflected XSS – POC

CVE-2026-0561 affects Shield Security and describes an unauthenticated reflected Cross-Site Scripting issue in versions up to and including 21.0.8. The vulnerable dynamic page renderer accepts the message parameter on the shield_action flow and reflects it into a generated page without sufficient sanitization and output escaping. An attacker does not need a WordPress account. They only need to persuade a victim to open a crafted URL, which can make script run in the victim browser under the site origin. For logged in administrators, that can expose WordPress nonces and allow authenticated browser actions through the victim session.