Plugin Security Certification (PSC) by CleanTalk

Plugin Security Certification (PSC-2026-65712): “Microsoft Clarity” – Version 0.10.37

Behavioral analytics integrations add tracking code and connect website activity to a remote reporting project. Microsoft Clarity version 0.10.37 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65712. The review focused on project configuration, permissions for analytics settings, tracking code output, integration data, and communication with Microsoft Clarity.

Plugin Security Certification (PSC-2026-65711): “TikTok” – Version 1.4.2

Advertising integrations connect a WordPress site to external accounts and send selected website events to a marketing platform. TikTok version 1.4.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65711. The review focused on administrator access to connection settings, account credentials, pixel configuration, event data, remote requests, and safe presentation of service responses.

WordPress Malware Keeps Coming Back? Check Database Triggers

CleanTalk DB Trigger Analysis showing fn_comment_insert_review with a Vulnerable trigger verdict

DB Trigger Analysis flagged a comment-driven trigger and removed it. A repeated comment stopped the extra database write while ordinary audit logging continued.

CVE-2026-13116 - PDF Invoices & Packing Slips for WooCommerce - IDOR - POC

CVE-2026-13116 is an insecure direct object reference in PDF Invoices & Packing Slips for WooCommerce through version 5.14.0. When Full document-link access is enabled, missing order-level authorization can allow a low-privileged content author to obtain a public link to another customer’s invoice or packing slip. Exposed documents may contain customer contact information, addresses, purchased items, totals and order notes. The supplied research describes version 5.9.2, while the public advisory identifies 5.15.0 as the first fixed release.

Limit WordPress Password Reset Email Spam with CleanTalk

WordPress password reset email spam comparison showing 50 emails before CleanTalk, five emails after and 45 denied requests

Fifty password reset requests produced fifty emails. CleanTalk limited the same sequence to five emails and 45 refusals. A later request delivered another email.

Website Malware Scanner That Crawls Every Page: Find Malware on Inner Pages

Diagram of the CleanTalk Website Malware Scanner crawling a site: the submitted URL plus robots.txt, sitemap.xml, wp-sitemap.xml and the feed fill a crawl queue, each page is analysed with the signature set, and infected URLs are collected in the report.

Malware often hides on inner pages while the homepage looks clean. The CleanTalk Website Malware Scanner now crawls the whole site – links, sitemaps, robots.txt and feeds – and lists every infected URL under Signatures.

CVE-2026-6459 - Essential Addons for Elementor - Stored XSS - POC

CVE-2026-6459 is a Stored Cross-Site Scripting vulnerability in Essential Addons for Elementor Lite through version 6.6.2. An authenticated Author or higher-privileged user who can publish The Events Calendar events and assign a featured image can save a crafted event title. Opening that event in the EA Event Calendar popup with a Body Left or Body Right thumbnail executes an injected image load handler in the viewing browser, including an administrator’s session. The issue is fixed in version 6.6.3.

CVE-2026-11328 – Exclusive Addons for Elementor – Stored XSS – POC

CVE-2026-11328 is a Stored Cross-Site Scripting vulnerability in Exclusive Addons for Elementor through version 2.7.9.8. A Contributor or higher-privileged user can save a crafted post title that is inserted into the Ex Duplicator link in the WordPress Posts list without attribute escaping. Moving the mouse over that link triggers the injected script in the viewing user’s browser. The issue is fixed in version 2.7.9.9.

CVE-2026-5821 – Image Optimizer – Author+ File Deletion – POC

CVE-2026-5821 affects Image Optimizer through version 1.7.4 and allows an authenticated Author to cause arbitrary file deletion through attachment backup metadata. The plugin trusts stored backup paths during attachment cleanup without checking that they belong to the expected image backups. Files writable by the web server may be removed, causing data loss, denial of service, or weakened site protection. The issue is fixed in version 1.7.5.

CVE-2026-104119 – Simple Shopping Cart – Admin+ Stored XSS via PayPal API Credentials – PoC

CVE-2026-104119: an Admin+ Stored XSS in the Simple Shopping Cart WordPress plugin (below 5.2.6), triggered through the PayPal API credentials settings. Details, timeline, impact on Multisite and remediation.