Security Archives - Page 4 of 71 - Plugin Security Certification (PSC) by CleanTalk

Plugin Security Certification (PSC-2026-64685): “Site Kit by Google – Analytics, Search Console, AdSense, Speed” – Version 1.186.0

Analytics and advertising integrations connect a WordPress dashboard to external services and expose site performance data to privileged users. Site Kit by Google – Analytics, Search Console, AdSense, Speed version 1.186.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64685, confirming that the review focused on service connections, dashboard data access, REST requests, administrator actions, and safe rendering of remote metrics.

CVE-2026-9125 – Presto Player – Contributor+ Stored XSS – POC

CVE-2026-9125 affects Presto Player and is an authenticated Contributor+ Stored Cross-Site Scripting vulnerability in versions up to and including 4.2.0. A malicious presto_player_overlay shortcode can preserve a javascript: URI in link_url, allowing attacker-controlled JavaScript to run in the WordPress origin when another user clicks the overlay during playback.

SPBCT Critical Updates: Known CVEs and PSC Records

CleanTalk SPBCT Critical Updates with Known vulnerabilities and PSC records from a WordPress dashboard

SPBCT Critical Updates separates known CVE matches from version-specific CleanTalk PSC records for installed WordPress plugins and themes.

CVE-2026-7526 – PDF Embedder – Information Exposure – POC

CVE-2026-7526 affects PDF Embedder <= 4.9.3 and exposes site-wide plugin settings to authenticated Contributor+ users through the global pdfembPluginOptions JavaScript object. A saved premium license key can also be disclosed when the premium add-on is installed.

CVE-2026-3985 – Creative Mail – Unauth SQL Injection – POC

CVE-2026-3985 affects Creative Mail <= 1.6.9 with unauthenticated time-based SQL injection in the abandoned checkout flow. A crafted checkout UUID reaches an unprepared SQL query and can be used to infer sensitive database data.

CVE-2025-15345 – MapGeo – Unauth Reflected XSS – POC

CVE-2025-15345 affects MapGeo – Interactive Geo Maps and is an unauthenticated reflected Cross-Site Scripting vulnerability in versions up to and including 1.6.27. When a public page uses the display-map shortcode in demo mode, an attacker can supply an external JavaScript URL through the map parameter and make the victim browser load it under the vulnerable site context.

CVE-2026-6229 – Royal Addons for Elementor – Contributor+ SSRF – POC

CVE-2026-6229 affects Royal Addons for Elementor and is an authenticated Contributor+ server-side request forgery vulnerability in the Data Table widget. In versions through 1.7.1057, a user-controlled CSV URL can bypass the Google Sheets substring check, reach arbitrary internal or external HTTP services, and expose response data after it is parsed into the rendered table.

SC WordPress Malware in functions.php, db.php, and 1j2d192.php: Polymorphic Loaders and CleanTalk Cure

CleanTalk analysis of SC WordPress malware in functions.php, db.php, and the example randomly named loader 1j2d192.php

See how SC WordPress malware infects functions.php, db.php, and randomly named PHP loaders, and how CleanTalk detects and safely cures verified matches.

CVE-2025-11762 – HubSpot – Missing Authorization – POC

CVE-2025-11762 affects HubSpot All-In-One Marketing and exposes installed plugin names and versions to authenticated Contributor+ users through the global leadinConfig JavaScript object.

How to Find and Remove Malicious ELF Files on Your Website: CleanTalk’s BinaryCheck Module

Most WordPress security scanners are good at catching malicious PHP code — web shells, injected theme and plugin files, suspicious eval() calls. But attackers have another tool in their arsenal: compiled binary files in ELF format (Executable and Linkable Format) — the standard executable format for Linux. Such a file contains no readable PHP code, doesn’t match familiar signatures found in plugin source files, and often has no file extension at all — so classic file scanners simply skip right past it.

This is exactly the gap that Security by CleanTalk’s new module — BinaryCheck — was built to close.