Plugin Security Certification (PSC) by CleanTalk

Effective Prevention Methods for XSS

Cross-site scripting (XSS) vulnerabilities occupy one of the first places in terms of frequency among the vulnerabilities found in WordPress plugins. These vulnerabilities occur when data from a user is not sufficiently cleaned before being displayed on site pages, which allows attackers to inject malicious code such as JavaScript and execute it in visitors’ browsers. XSS attacks can lead to theft of user data, hijacking of sessions, modification of page content, and other types of malicious activity

CVE-2024-9600 – Ditty – Stored XSS to Admin Account Creation – POC

The Ditty plugin, designed for displaying custom feeds and lists of posts in WordPress, has been found to contain a critical vulnerability that allows an attacker to exploit a Stored Cross-Site Scripting (XSS) flaw. This vulnerability, identified as CVE-2024-9600, can be used by contributors to inject malicious JavaScript code into new posts, which upon interaction can lead to the creation of an admin account. With approximately 50,000 active installations, this vulnerability poses a serious risk to WordPress sites utilizing the Ditty plugin.

CVE-2024-10515 – Squirrly SEO (Newton) – Stored XSS to Backdoor Creation – POC

The Squirrly SEO plugin, a popular tool for search engine optimization in WordPress, has been found to harbor a critical vulnerability, CVE-2024-10515. This flaw allows attackers to exploit a Stored Cross-Site Scripting (XSS) vulnerability through the plugin’s SEO settings. By embedding malicious JavaScript code into the “Meta Keywords” field in the SEO Snippet settings, attackers can execute arbitrary scripts, leading to account takeover and backdoor creation. With over 100,000 active installations, this vulnerability poses a serious risk to WordPress sites using the plugin.

CVE-2024-10103 – MailPoet – Newsletters, Email Marketing, and Automation – Stored XSS to Backdoor Creation – POC

The MailPoet plugin, widely used for newsletter management, email marketing, and automation in WordPress, has been found to contain a severe security vulnerability. This vulnerability, identified as CVE-2024-10103, allows an attacker to execute a Stored Cross-Site Scripting (XSS) attack through the “Custom HTML” block when creating a new form. The flaw grants the attacker the ability to embed malicious JavaScript code, leading to account takeover and backdoor creation. With over 700,000 active installations, this vulnerability poses a significant risk to WordPress sites that utilize the plugin.

CVE-2024-10027 – WP Booking Calendar – Stored XSS to Backdoor Creation in Widget – POC

The WP Booking Calendar plugin, widely utilized for managing appointments and bookings on WordPress sites, has been found to contain a critical security vulnerability. This flaw allows attackers to exploit the widget feature through a Stored Cross-Site Scripting (XSS) attack, ultimately leading to account takeover and the creation of backdoors. As the plugin boasts approximately 50,000 installations, it is vital for users to understand the implications of this vulnerability and take necessary precautions.

CVE-2024-7879 – WP-ULike – Stored XSS to Backdoor Creation in Widget – POC

CVE-2024-7879 exposes a critical Stored Cross-Site Scripting (XSS) vulnerability in the WP-ULike plugin, a popular WordPress plugin with over 100,000 active installations used for tracking user reactions. This flaw allows attackers with editor-level permissions to inject malicious JavaScript into the

Plugin Security Certification (PSC-2024-64530): “Fluent Forms” – Version 6.0.2: Use Forms with Enhanced Security

Fluent Forms has passed a thorough security assessment and received the prestigious Plugin Security Certification (PSC) from CleanTalk, which guarantees users a secure environment for managing forms.
Fluent Forms is a comprehensive and secure contact form builder designed for WordPress. With an intuitive drag-and-drop interface, Fluent Forms provides a wide range of features that are suitable for both beginners and advanced users. Recognized for its performance, Fluent Forms loads quickly without overloading your site and offers a wide range of powerful form functionality. The security features of the plugin ensure the protection of user data, and the advanced customization options make it a universal choice for any WordPress website.

And now, thanks to the security certification of the plugin (PSC-2024-64530) from CleanTalk, you can use Fluent Forms with a guarantee of increased security. This certification confirms that Fluent Forms has passed a thorough security check, which makes it a reliable means of managing the contact form builder without introducing vulnerabilities to your WordPress site.

CVE-2024-5578 – Table of Contents Plus – Stored XSS to Backdoor Creation – POC

CVE-2024-5578 exposes a critical Stored Cross-Site Scripting (XSS) vulnerability in the Table of Contents Plus plugin, widely used in WordPress for creating table of contents sections within posts and pages. With over 300,000 installations, this plugin is a valuable tool for content-heavy websites. However, this vulnerability allows attackers to embed malicious JavaScript code within the plugin’s settings, specifically in the “Hide text” field. If exploited, this vulnerability can lead to backdoor creation, admin account takeover, and long-term control of the WordPress site.

CVE-2024-9883 – Pods – Custom Content Types and Fields – Stored XSS to Backdoor Creation – POC

CVE-2024-9883 uncovers a critical vulnerability in the Pods – Custom Content Types and Fields plugin, a popular WordPress plugin with over 100,000 active installations. This vulnerability enables attackers with editor-level permissions to inject malicious JavaScript (JS) into the plugin’s settings, allowing them to create backdoors and perform admin account takeovers. The vulnerability is due to insufficient sanitization within the “Heading HTML tag” setting of custom content fields.

CVE-2024-10362 – Social Media Share Buttons – Stored XSS to Backdoor Creation – POC

CVE-2024-10362 exposes a Stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Social Media Icons WordPress plugin. This popular plugin allows WordPress site administrators to display customizable social media icons, enabling visitors to share content across platforms like Facebook, Twitter, LinkedIn, and more. Unfortunately, a flaw in its handling of user inputs can permit attackers to inject malicious JavaScript code, paving the way for serious security risks. This article explores how the vulnerability was discovered, the potential impact on WordPress sites, and practical steps to protect against such attacks.