Plugin Security Certification (PSC) by CleanTalk

Use only certified WordPress plugins for your website

CVE-2024-10103 – MailPoet – Newsletters, Email Marketing, and Automation – Stored XSS to Backdoor Creation – POC

The MailPoet plugin, widely used for newsletter management, email marketing, and automation in WordPress, has been found to contain a severe security vulnerability. This vulnerability, identified as CVE-2024-10103, allows an attacker to execute a Stored Cross-Site Scripting (XSS) attack through the “Custom HTML” block when creating a new form. The flaw grants the attacker the ability to embed malicious JavaScript code, leading to account takeover and backdoor creation. With over 700,000 active installations, this vulnerability poses a significant risk to WordPress sites that utilize the plugin.

CVE-2024-10027 – WP Booking Calendar – Stored XSS to Backdoor Creation in Widget – POC

The WP Booking Calendar plugin, widely utilized for managing appointments and bookings on WordPress sites, has been found to contain a critical security vulnerability. This flaw allows attackers to exploit the widget feature through a Stored Cross-Site Scripting (XSS) attack, ultimately leading to account takeover and the creation of backdoors. As the plugin boasts approximately 50,000 installations, it is vital for users to understand the implications of this vulnerability and take necessary precautions.

CVE-2024-7879 – WP-ULike – Stored XSS to Backdoor Creation in Widget – POC

CVE-2024-7879 exposes a critical Stored Cross-Site Scripting (XSS) vulnerability in the WP-ULike plugin, a popular WordPress plugin with over 100,000 active installations used for tracking user reactions. This flaw allows attackers with editor-level permissions to inject malicious JavaScript into the

Plugin Security Certification (PSC-2024-64530): “Fluent Forms” – Version 5.2.5: Use Forms with Enhanced Security

Fluent Forms has passed a thorough security assessment and received the prestigious Plugin Security Certification (PSC) from CleanTalk, which guarantees users a secure environment for managing forms.
Fluent Forms is a comprehensive and secure contact form builder designed for WordPress. With an intuitive drag-and-drop interface, Fluent Forms provides a wide range of features that are suitable for both beginners and advanced users. Recognized for its performance, Fluent Forms loads quickly without overloading your site and offers a wide range of powerful form functionality. The security features of the plugin ensure the protection of user data, and the advanced customization options make it a universal choice for any WordPress website.

And now, thanks to the security certification of the plugin (PSC-2024-64530) from CleanTalk, you can use Fluent Forms with a guarantee of increased security. This certification confirms that Fluent Forms has passed a thorough security check, which makes it a reliable means of managing the contact form builder without introducing vulnerabilities to your WordPress site.

CVE-2024-5578 – Table of Contents Plus – Stored XSS to Backdoor Creation – POC

CVE-2024-5578 exposes a critical Stored Cross-Site Scripting (XSS) vulnerability in the Table of Contents Plus plugin, widely used in WordPress for creating table of contents sections within posts and pages. With over 300,000 installations, this plugin is a valuable tool for content-heavy websites. However, this vulnerability allows attackers to embed malicious JavaScript code within the plugin’s settings, specifically in the “Hide text” field. If exploited, this vulnerability can lead to backdoor creation, admin account takeover, and long-term control of the WordPress site.

CVE-2024-9883 – Pods – Custom Content Types and Fields – Stored XSS to Backdoor Creation – POC

CVE-2024-9883 uncovers a critical vulnerability in the Pods – Custom Content Types and Fields plugin, a popular WordPress plugin with over 100,000 active installations. This vulnerability enables attackers with editor-level permissions to inject malicious JavaScript (JS) into the plugin’s settings, allowing them to create backdoors and perform admin account takeovers. The vulnerability is due to insufficient sanitization within the “Heading HTML tag” setting of custom content fields.

CVE-2024-10362 – Social Media Share Buttons – Stored XSS to Backdoor Creation – POC

CVE-2024-10362 exposes a Stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Social Media Icons WordPress plugin. This popular plugin allows WordPress site administrators to display customizable social media icons, enabling visitors to share content across platforms like Facebook, Twitter, LinkedIn, and more. Unfortunately, a flaw in its handling of user inputs can permit attackers to inject malicious JavaScript code, paving the way for serious security risks. This article explores how the vulnerability was discovered, the potential impact on WordPress sites, and practical steps to protect against such attacks.

CVE-2024-9768 – Formidable Forms – Stored XSS to Backdoor Creation – POC

CVE-2024-9768 reveals a Stored Cross-Site Scripting (XSS) vulnerability in the Formidable Forms WordPress plugin, a leading tool for creating forms, surveys, and other interactive content on websites. Known for its advanced drag-and-drop interface and extensive customization options, Formidable Forms is widely used by WordPress sites for generating user-friendly forms. However, this vulnerability can allow malicious actors to inject JavaScript payloads that can ultimately create backdoors, compromising site security and exposing user data. This article delves into the nature of this vulnerability, how it can be exploited, and the potential impact on affected websites.

CVE-2024-9233 – GS Logo Slider – Unauth Settings Update via Cross-Site Request Forgery (CSRF) – POC

CVE-2024-9233 is a newly discovered vulnerability in the GS Logo Slider plugin, which is installed on over 50,000 WordPress sites. This vulnerability exposes the plugin to Cross-Site Request Forgery (CSRF) attacks, enabling unauthorized users to manipulate plugin settings on behalf of an authenticated user without their consent. Exploiting this vulnerability can result in unwanted changes to the plugin’s configuration, potentially impacting site functionality and security.

CVE-2024-9599 – Popup Box – Stored XSS to Backdoor Creation – POC

CVE-2024-9599 brings to light a critical Stored Cross-Site Scripting (XSS) vulnerability within the WordPress Popup Box plugin, a popular tool used to create a variety of popups for websites. This plugin allows users to add visually appealing and engaging popups, ranging from promotional notifications to subscription forms, without requiring extensive technical knowledge. However, an identified flaw in the way the plugin handles input parameters allows malicious users to inject JavaScript code, leading to the potential creation of backdoors within the WordPress environment. The implications of this vulnerability could lead to unauthorized access and control over affected websites.