Plugin Security Certification (PSC) by CleanTalk

Plugin Security Certification (PSC-2025-64572): “Hostinger Tools” – Version 3.0.55: Use Tools with Enhanced Security

Hostinger Tools is a powerful all-in-one plugin developed to simplify and secure key administrative tasks on WordPress websites. Designed with both functionality and safety in mind, it allows users to efficiently manage essential settings such as maintenance mode, PHP/WordPress version visibility, HTTPS/WWW redirects, and core security toggles — all from a centralized, intuitive interface.

Built by one of the most reputable hosting providers, Hostinger Tools not only optimizes site control for administrators but also integrates strong security mechanisms to safeguard WordPress environments. This plugin has successfully undergone in-depth security evaluation and received the Plugin Security Certification (PSC) from CleanTalk, validating its compliance with modern secure coding standards.

CVE-2024-12273 – Calculated Fields Form – Stored XSS to JS Backdoor Creation – POC

The Calculated Fields Form plugin is a widely adopted WordPress tool used for creating forms with dynamically calculated fields based on user input. With over 50,000 active installations, it powers various contact forms, booking interfaces, quote generators, and more. Despite its powerful features, a significant security vulnerability has been discovered: CVE-2024-12273, a Stored Cross-Site Scripting (XSS) flaw that can be leveraged by an attacker to inject persistent JavaScript code and deploy a full JavaScript-based backdoor. This allows account takeover and, in worst-case scenarios, full administrative compromise.

Plugin Security Certification (PSC-2025-64571): “BackWPup – WordPress Backup & Restore Plugin” – Version 5.6.0: Use Footer with Enhanced Security

BackWPup is one of the most trusted and feature-rich backup and restore plugins for WordPress, offering both flexibility and robust protection for your website’s data. Developed by WP Media—the team behind WP Rocket—BackWPup allows you to create complete backups of your WordPress installation and store them safely on external services such as Dropbox, Amazon S3, Google Drive, OneDrive, and more.

But beyond its impressive features, what sets BackWPup v5.5.2 apart is its strong commitment to security. The plugin has undergone a thorough security review, code analysis, and penetration testing process, earning it the official Plugin Security Certification (PSC) with the identifier PSC-2025-64571, issued by CleanTalk

Plugin Security Certification (PSC-2025-64570): “Header Footer Code Manager” – Version 1.1.43: Use Footer with Enhanced Security

Header Footer Code Manager (HFCM) by 99 Robots is a powerful and secure WordPress plugin designed to safely insert custom code snippets (HTML, JavaScript, or CSS) into the header, footer, or content areas of your website without altering theme files. Whether you need to add analytics scripts, advertising tags, or verification codes, HFCM provides an intuitive interface that eliminates the risks associated with direct theme modification.

By allowing precise placement of scripts on specific pages, posts, categories, or devices, HFCM helps streamline performance and simplify site administration—all while keeping your codebase safe and organized.

Following a rigorous code review and penetration testing process, HFCM has earned the Plugin Security Certification (PSC) with ID PSC-2025-64570, issued by CleanTalk, confirming adherence to best practices in secure plugin development.

CVE-2025-0627 – AI Autotagger (Taxo Press) – Stored XSS to JS Backdoor Creation – POC

AI Autotagger (Taxo Press) is a popular plugin used in WordPress for automatically tagging posts and improving the content classification process. It helps users to efficiently manage taxonomies and tags across their site, saving time and improving content visibility. However, a critical vulnerability, CVE-2025-0627, was discovered in the plugin, which allows attackers to inject malicious scripts, enabling a backdoor creation that can lead to account takeover. This vulnerability is a stored Cross-Site Scripting (XSS) flaw that can be exploited by users with editor privileges.

CVE-2025-48277 – WP Cost Calculator Builder – Stored XSS to JS Backdoor Creation – POC

The WP Cost Calculator Builder is a widely used WordPress plugin that allows website owners to create dynamic pricing and estimation forms using an intuitive drag-and-drop interface. With over 20 flexible form elements and deep integration into e-commerce platforms like WooCommerce, it serves as a powerful tool for businesses that want to provide cost estimation on their services and products.

However, versions up to 3.2.74 of the plugin are vulnerable to a Stored Cross-Site Scripting (XSS) attack that allows malicious JavaScript code to be injected and persistently executed in the browser of any visitor who views the infected form.

CVE-2025-1453 – Category Posts Widget – Stored XSS to JS Backdoor Creation – POC

The Category Posts Widget is a popular WordPress plugin that allows users to display posts from specified categories in a widget format. It is often used to enhance the user experience by providing dynamic content related to specific categories. However, a critical vulnerability has been discovered—CVE-2025-1453—that allows attackers to exploit stored XSS within the widget’s settings. This vulnerability enables attackers with editor-level permissions to inject malicious JavaScript, leading to potential backdoor creation and full account takeover.

CVE-2025-0671 – Email Subscribers – Stored XSS to JS Backdoor Creation – POC

Email Subscribers is a widely used plugin in WordPress, allowing users to manage email subscriptions, newsletters, and automated email campaigns. It is a valuable tool for website administrators looking to engage with their users via email marketing. However, CVE-2025-0671, a stored Cross-Site Scripting (XSS) vulnerability, has been discovered in the plugin that enables an attacker to inject malicious JavaScript into the site. This stored XSS vulnerability could lead to the creation of backdoors for attackers, potentially resulting in full site compromise, including admin account takeover.

CVE-2025-4567 – Post Slider and Carousel with Widget < 3.2.10 – Stored XSS to JS Backdoor Creation – POC

Vulnerability was discovered in the widely-used WordPress plugin Post Slider and Carousel with Widget, which allows site owners to display posts in sliders or carousels. This plugin is favored for its ease of use and flexibility, especially for non-technical users.

The vulnerability, now identified as CVE-2025-4567, affects plugin versions below 3.2.10 and allows an authenticated user (with access to widget settings) to inject stored JavaScript code into a field that is later rendered on the front-end — leading to persistent Cross-Site Scripting (XSS) and the potential creation of a JavaScript backdoor.

CVE-2024-11924 – Email Subscribers – Stored XSS to JS Backdoor Creation – POC

Email Subscribers is a WordPress plugin designed to simplify the process of managing email subscriptions, newsletters, and automated email campaigns. With over 80,000 active installations, it is widely used by website administrators for email marketing and user engagement. However, a critical vulnerability, CVE-2024-11924, has been identified within the plugin that allows for the implementation of stored Cross-Site Scripting (XSS). This vulnerability enables an attacker with editor-level access to inject malicious JavaScript, leading to a potential backdoor creation and full admin account takeover.