Plugin Security Certification (PSC) by CleanTalk

CVE-2025-9111 – WPBOT – Stored XSS – POC

WPBot is a WordPress plugin that provides an AI-powered chatbot for websites, enabling live chat support, lead generation, and data collection. It integrates with OpenAI, ChatGPT, and other LLM services, while also offering built-in automated support without external AI dependencies.

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in WPBot Lite that allows users to inject malicious scripts via the FAQ Builder, affecting users with sufficient access (such as contributors or admins reviewing FAQs). This vulnerability can lead to account compromise, data exfiltration, and site takeover.

Plugin Security Certification (PSC-2025-64586): “WP Downgrade” – Version 1.2.6: Use Automatic Update WP with Enhanced Security

WP Downgrade | Specific Core Version is a vital WordPress plugin that allows administrators to downgrade or update their WordPress Core to a specific release. Unlike the default WordPress update routine, which only installs the latest release, this plugin provides flexible control over Core updates, enabling users to remain on a previous secure version or selectively update to compatible releases.

This is particularly useful for sites relying on plugins or themes that are not yet compatible with the latest WordPress release. By forcing WordPress to recognize a chosen version as the latest, WP Downgrade simplifies updates while maintaining compatibility and stability.

With the new advanced option, users can manually adjust the download link, enabling tasks like language-specific core downloads or fetching releases from alternative sources—all without compromising security.

CVE-2025-8891 – OceanWP [THEME] – Cross-Site Request Forgery to Ocean Extra Plugin Installation – POC

OceanWP is a widely adopted WordPress theme, boasting over 50,000 active installations thanks to its performance-optimized code and extensive customization options. To further extend its capabilities, it relies on a companion plugin, Ocean Extra, which adds demo import, custom widgets, and additional theme settings. However, a critical vulnerability—CVE-2025-8891—has been discovered: an unauthenticated Cross-Site Request Forgery (CSRF) flaw that allows any visitor to invoke the oceanwp_notice_button_click AJAX action. This function, when called, automatically installs or activates the Ocean Extra plugin, effectively granting low-privileged users the ability to install new code on the site without any consent or proper authorization checks.

Plugin Security Certification (PSC-2025-64585): “Auto Image Attributes From Filename With Bulk Updater” – Version 4.7.1: Use Image SEO with Enhanced Security

Auto Image Attributes From Filename With Bulk Updater (v4.6) is a powerful WordPress plugin designed to automate the generation of essential image attributes—Alt Text, Title, Caption, and Description—directly from image filenames. By restoring and enhancing features that WordPress deprecated in earlier versions, this plugin significantly boosts both SEO and website accessibility.

Properly defined image attributes not only improve Google, Yahoo, and Bing image search rankings, but also ensure compliance with accessibility standards by helping users with visual impairments understand the content of your images.

With its bulk updater, administrators can quickly optimize entire media libraries in a single click, saving valuable time while ensuring consistency across all images.

CVE-2025-8595 – Zakra [THEME] – Missing Authorization to Subscriber+ Demo Import – POC

The Zakra WordPress theme, installed on over 50,000 websites, provides a one-click demo import feature that streamlines site setup by loading predefined layouts, widgets, and content. However, a critical vulnerability—CVE-2025-8595—allows even low-privileged Subscriber+ users to invoke the demo import process via the import_button AJAX action. By exploiting a publicly exposed nonce, attackers can import arbitrary demo content, modify site configuration, or trigger long-running operations, thereby disrupting the site or preparing for further privilege escalations.

Plugin Security Certification (PSC-2025-64584): “Joinchat” – Version 6.0.6: Use Chat Integrations with Enhanced Security

While its functionality is impressive, security remains a critical factor when embedding third-party scripts and handling visitor interactions. A vulnerable chat plugin could become a direct entry point for attackers—risking data leakage, phishing, and even complete site compromise. Recognizing this, Joinchat version 6.0.6 underwent an extensive Plugin Security Certification process by CleanTalk and has successfully earned PSC-2025-64584.

Plugin Security Certification (PSC-2025-64583): “String locator” – Version 2.6.7: Use Search locator with Enhanced Security

String Locator is a specialized WordPress plugin designed to help developers, administrators, and site managers quickly find and edit text strings within themes, plugins, and even WordPress core files. This tool eliminates the guesswork of locating hardcoded text by providing precise search results, including file paths, matching lines, and contextual previews.

The plugin also features in-browser editing, allowing you to make changes directly from the search results. Before saving, it runs a built-in consistency check that scans for unbalanced braces, brackets, and parentheses, reducing the risk of syntax errors and broken functionality. While not a substitute for full testing, this safeguard significantly minimizes common editing mistakes.

For maximum safety, it’s recommended to work on a staging site before deploying changes to production.

CVE-2025-6790 – Quiz And Survey Master (QSM) – Template Creation via CSRF – POC

Quiz And Survey Master (QSM) is a powerful WordPress plugin used to design and deploy quizzes, surveys, and assessments, with over 50,000 active installations. Despite its extensive use for educational and marketing purposes, a critical vulnerability—CVE-2025-6790—has been identified that permits unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) against its AJAX endpoint for quiz template creation. This flaw allows an attacker to inject arbitrary templates into the system, potentially enabling further administrative actions or content hijacking without requiring any valid credentials.

Plugin Security Certification (PSC-2025-64582): “Everest Forms” – Version 3.4.1: Use Awesome Forms with Enhanced Security

Everest Forms has officially passed the Plugin Security Certification (PSC-2025-64582), issued by CleanTalk, following an exhaustive security audit. This validation affirms that Everest Forms is not only powerful in capability but also hardened against modern web threats, making it a safe solution for any WordPress website—personal, corporate, or eCommerce.

CVE-2025-8015 – Shortcodes Ultimate – Stored XSS (Author+) to Admin Account Creation – POC

Shortcodes Ultimate is a ubiquitous WordPress plugin used by over 500,000 websites to effortlessly embed rich content—galleries, tabs, sliders—through simple shortcode syntax. While its drag-and-drop gallery builder and extensive shortcode library enhance user experience, a serious security flaw—CVE-2025-8015—has been discovered. This vulnerability permits an Author+ user to inject persistent JavaScript into gallery items (via image links or titles), which executes when administrators or other privileged users interact with the gallery. Ultimately, attackers can escalate privileges, create admin backdoors, and fully compromise the site.