Search notification plugins transmit site URLs to indexing services when content is created, updated, or removed. IndexNow Plugin version 1.0.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65718. The review focused on submission permissions, API key handling, automatic publishing events, URL exclusions, manual requests, submission history, and external communication.
Plugin Security Certification (PSC-2026-65717): “SSL Insecure Content Fixer” – Version 2.7.2

Mixed content correction changes resource URLs and page output so an HTTPS site can load its assets consistently. SSL Insecure Content Fixer version 2.7.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65717. The review focused on administrative settings, correction levels, HTTPS detection, content rewriting, multisite defaults, and safe output handling.
Plugin Security Certification (PSC-2026-65716): “Customizer Export/Import” – Version 0.9.8

Theme settings migration processes uploaded configuration data and can replace values that control a live site appearance. Customizer Export/Import version 0.9.8 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65716. The review focused on Customizer permissions, export output, uploaded settings validation, theme compatibility, option import, and optional image handling.
Plugin Security Certification (PSC-2026-65715): “Page Links To” – Version 3.4.1

Custom link destinations change where visitors go when they open a WordPress entry or follow its title. Page Links To version 3.4.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65715. The review focused on post editing permissions, destination URL validation, saved link metadata, redirect behavior, and output of replacement links.
Plugin Security Certification (PSC-2026-65714): “Post Type Switcher” – Version 4.1.1

Changing a post type can move existing content between editing workflows, templates, and publication controls. Post Type Switcher version 4.1.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65714. The review focused on editing permissions, target post type validation, individual and bulk changes, editor integration, and preservation of existing content.
Plugin Security Certification (PSC-2026-65713): “Nginx Helper” – Version 2.4.1

Cache management integrations connect WordPress publishing events to server cache purges and deployment specific routing rules. Nginx Helper version 2.4.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65713. The review focused on cache purge permissions, purge settings, URL handling, publishing events, Redis integration, and dashboard output.
Plugin Security Certification (PSC-2026-65712): “Microsoft Clarity” – Version 0.10.37

Behavioral analytics integrations add tracking code and connect website activity to a remote reporting project. Microsoft Clarity version 0.10.37 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65712. The review focused on project configuration, permissions for analytics settings, tracking code output, integration data, and communication with Microsoft Clarity.
Plugin Security Certification (PSC-2026-65711): “TikTok” – Version 1.4.2

Advertising integrations connect a WordPress site to external accounts and send selected website events to a marketing platform. TikTok version 1.4.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65711. The review focused on administrator access to connection settings, account credentials, pixel configuration, event data, remote requests, and safe presentation of service responses.
WordPress Malware Keeps Coming Back? Check Database Triggers
CVE-2026-13116 - PDF Invoices & Packing Slips for WooCommerce - IDOR - POC

CVE-2026-13116 is an insecure direct object reference in PDF Invoices & Packing Slips for WooCommerce through version 5.14.0. When Full document-link access is enabled, missing order-level authorization can allow a low-privileged content author to obtain a public link to another customer’s invoice or packing slip. Exposed documents may contain customer contact information, addresses, purchased items, totals and order notes. The supplied research describes version 5.9.2, while the public advisory identifies 5.15.0 as the first fixed release.
