Plugin Security Certification (PSC) by CleanTalk

Author box plugins are security-relevant because they render user-controlled profile data across the site, often including author bio text, website links, and social profiles. If output encoding, access control, or request integrity is weak, these surfaces can become a path to stored XSS, unauthorized profile metadata exposure, or CSRF-driven settings changes. Simple Author Box version 2.59 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64639, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for author profile and bio display plugins.

File manager plugins are security-relevant by design because they provide direct filesystem access from wp-admin, including upload, download, edit, delete, and archive operations that normally require FTP or hosting panel access. If access control, request integrity, or path handling is weak, these features can become a shortcut to data exposure, site defacement, or availability impact. File Manager Pro – Filester version 2.0.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64638, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for WordPress file management tools.

MainWP Child – Securely Connects to the MainWP Dashboard (v6.0.5) is a WordPress plugin designed to establish a secure connection between individual WordPress sites and a self-hosted MainWP Dashboard. This architecture allows centralized management of multiple websites, including updates, backups, monitoring, and content administration.

Built for websites running on WordPress, the plugin acts as a controlled communication bridge between managed sites and the MainWP Dashboard.

Due to its role in remote management and cross-site communication, MainWP Child operates in a highly sensitive security context. As a result, a comprehensive security audit of its codebase and communication mechanisms was conducted.

Spectra Gutenberg Blocks (v2.19.21) is an advanced extension for the WordPress block editor (Gutenberg), providing over 30 customizable blocks, layout tools, templates, and UI components for building modern websites without coding.

Designed for websites running on WordPress, Spectra enhances the native editor instead of replacing it, allowing users to build feature-rich pages while maintaining compatibility with WordPress core architecture.

With over 1+ million active installations, Spectra operates at a critical layer of content rendering and user interaction. Due to its complexity and broad functionality (including dynamic content, forms, popups, and frontend rendering), a comprehensive security audit was conducted.

Caching integrations are security-relevant because they introduce high-impact configuration inside wp-admin and can directly affect availability and content delivery behavior. If access control, request integrity, or output handling is weak, attackers may force cache purges or mode changes via CSRF, expose sensitive diagnostics, or manipulate settings that impact how pages are cached and served. Aruba HiSpeed Cache version 3.0.10 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64635, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for hosting-cache and performance management plugins.

Slider and page builder addons expand the WordPress attack surface because they introduce rich front-end rendering, store complex widget settings, and often allow custom styling or script-like configuration through builder controls. In practice, weaknesses here most commonly translate into stored XSS through unsafe output, CSRF-driven settings changes, unauthorized access to editing features, or information disclosure via misprotected endpoints and diagnostics. Prime Slider – Addons for Elementor version 4.1.10 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64634, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for Elementor widget and content-rendering plugins.

Migration plugins are security-relevant because they operate with high privilege, touch both the filesystem and the database, and often require sensitive destination details like FTP/cPanel credentials or a migration key. If access control, request integrity, or input/output handling is weak, attackers may trigger unauthorized migrations, leak migration metadata, force configuration changes via CSRF, or abuse migration logic to cause resource exhaustion. Migrate Guru – Site Migration & Cloning version 6.28 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64633, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for site migration and cloning workflows.

Security plugins are uniquely sensitive in WordPress because they operate with high privilege, touch authentication and request filtering, and often integrate with external scanning and firewall services. If access control, request integrity, or output handling is weak, attackers may force configuration changes via CSRF, abuse endpoints to leak site security metadata, or inject malicious content into admin-facing reports. MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall version 6.39 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64632, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for WordPress security and monitoring plugins.

CDN and caching integrations are security-relevant because they introduce privileged configuration flows inside wp-admin, handle API tokens, and can directly affect availability and security posture at the edge. If access control, request integrity, or output handling is weak, attackers may force cache purges or mode changes via CSRF, expose sensitive integration metadata, or manipulate settings that impact how the site is protected and cached. Cloudflare version 4.14.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64631, confirming that the plugin was reviewed from a secure code perspective with attention to the most common exploitation paths for CDN, caching, and edge-security integration plugins.

SpeedyCache – Cache, Optimization, Performance (v1.3.7) is a WordPress performance plugin designed to improve website speed through caching, minification, compression, and resource optimization. By generating static cache files and optimizing frontend assets, the plugin reduces server load and accelerates page delivery.

Built for websites running on WordPress, SpeedyCache provides a comprehensive optimization toolkit while maintaining compatibility with shared hosting environments and CDN integrations.

Given its deep interaction with caching layers, file generation, HTTP headers, and resource processing, a detailed security audit was conducted.