cleantalk

Vulnerabilities and Security Researches

Recent vulnerability researches

CVE/PSC Application Date Affected versions Description
Actual on: Jul 27, 2026, 01:07:24

CVE-2026-14183

Classified Listing – Classified ads & Business Directory Plugin

vulnerable

Jul 24, 2026, 01:07:03
Min -
Max 5.3.9
 The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.

CVE-2026-14185

AI ChatBot

vulnerable

Jul 23, 2026, 23:07:52
Min -
Max 8.2.0
 The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.

CVE-2026-14184

Academy LMS – eLearning and online course solution for WordPress

vulnerable

Jul 23, 2026, 23:07:24
Min -
Max 3.8.1
 The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.

CVE-2026-59522

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting

vulnerable

Jul 23, 2026, 19:07:46
Min -
Max 1.17.6
 Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

CVE-2026-1372

Tutor LMS Elementor Addons

vulnerable

Jul 23, 2026, 12:07:03
Min -
Max 4.0.0
 The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.

CVE-2026-61944

WordPress Online Booking and Scheduling Plugin – Bookly

vulnerable

Jul 23, 2026, 06:07:37
Min -
Max 27.8
 Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 27.8 CVE-2026-61944

CVE-2026-61949

WordPress Online Booking and Scheduling Plugin – Bookly

vulnerable

Jul 23, 2026, 06:07:37
Min -
Max 27.8
 Online Scheduling and Appointment Booking System – Bookly [bookly-responsive-appointment-booking-tool] < 27.8 CVE-2026-61949

CVE-2026-11868

WP Travel &#8211; Best Travel Booking WordPress Plugin, Tour Management Engine

vulnerable

Jul 23, 2026, 05:07:19
Min -
Max 11.7.1
 The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

CVE-2026-12972

PayPlus Payment Gateway

vulnerable

Jul 23, 2026, 05:07:06
Min -
Max 8.2.2
 The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.

CVE-2026-12973

PayPlus Payment Gateway

vulnerable

Jul 23, 2026, 05:07:06
Min -
Max 8.2.2
 The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.

Recent approved applications

Application Date Description Details
Actual on: Jul 27, 2026, 01:07:24

Jetpack – WP Security, Backup, Speed, & Growth

Jun 25, 2026, 16:06:39 Security and performance suites operate across many areas of a WordPress installation, including backups, malware scanning, content delivery, statistics, forms, and social publishing. That makes them operationally useful, but also security-sensitive because a broad plugin footprint can affect privileged settings, connected service tokens, public scripts, and administrator workflows. Jetpack - WP Security, Backup, Speed, and Growth version 15.9.1 has successfully completed the CleanTalk Plugin Security Certi...

Admin and Site Enhancements (ASE)

Jun 25, 2026, 16:06:39 Administrative enhancement plugins concentrate many privileged controls in one interface, including editor behavior, media tools, SMTP settings, menu changes, and site management modules. That makes them efficient for administrators, but also security-sensitive because broad settings can affect core WordPress behavior. Admin and Site Enhancements (ASE) version 8.8.5 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64673, confirming that the plugin was revi...

Really Simple CAPTCHA

Jun 25, 2026, 16:06:39 CAPTCHA helper plugins sit close to form submission flows, generated challenge files, temporary tokens, and validation results used by other plugins. That makes them useful against automated abuse, but also security-sensitive because weak file handling or predictable challenge behavior can affect public forms. Really Simple CAPTCHA version 2.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64669, confirming that the plugin was reviewed from a secure code...

Mailchimp for WooCommerce

Jun 25, 2026, 16:06:39 Email marketing integrations process order activity, customer profiles, product metadata, cart events, and API credentials. That makes them useful for store communication, but also security-sensitive because customer related data moves between WooCommerce and an external marketing platform. Mailchimp for WooCommerce version 6.1.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64671, confirming that the plugin was reviewed from a secure code perspective w...

Font Awesome

Jun 25, 2026, 16:06:39 Icon plugins affect the editor, public markup, scripts, styles, and sometimes external kit configuration. That makes them convenient for visual design, but also security-sensitive because stored icon settings and asset URLs can become part of the public HTML served to visitors. Font Awesome version 5.1.5 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64668, confirming that the plugin was reviewed from a secure code perspective with attention to common ex...

Pinterest for WooCommerce

Jun 25, 2026, 16:06:39 Commerce marketing integrations handle product data, tracking events, connected account settings, and background synchronization. That makes them valuable for store growth, but also security-sensitive because merchant configuration and catalog data can affect both customer privacy and public product visibility. Pinterest for WooCommerce version 1.4.27 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64670, confirming that the plugin was reviewed from a sec...

Facebook Chat Plugin &#8211; Live Chat Plugin for WordPress

Jun 25, 2026, 16:06:39 Live chat plugins add third-party scripts, public widgets, and administrator managed page identifiers to WordPress pages. That makes them useful for customer communication, but also security-sensitive because stored settings are rendered to visitors and external script behavior becomes part of the public site surface. Facebook Chat Plugin - Live Chat Plugin for WordPress version 2.5 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64667, confirming that th...

Page Optimize

Jun 25, 2026, 16:06:39 Page optimization plugins change how scripts, styles, and front-end resources are loaded. That makes them useful for performance, but also security-sensitive because optimized output becomes part of every public page and can affect forms, commerce, analytics, and security controls. Page Optimize version 0.6.3 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64674, confirming that the plugin was reviewed from a secure code perspective with attention to comm...

Advanced Google reCAPTCHA

Jun 25, 2026, 16:06:39 Anti-spam plugins protect login, registration, comment, and public form paths. That makes them useful against automated abuse, but also security-sensitive because enforcement failures can leave high-value endpoints exposed or block legitimate visitors from expected workflows. Advanced Google reCAPTCHA version 5.39 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64672, confirming that the plugin was reviewed from a secure code perspective with attention to...

Instant Images &#8211; One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels

May 26, 2026, 14:05:15 Image import plugins bridge WordPress with external media providers, proxy services, remote image URLs, metadata processing, and the local Media Library. That workflow improves publishing speed, but it also expands the attack surface around remote downloads, MIME validation, alt text and caption handling, attribution metadata, and editor integrations. Instant Images version 7.1.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64662, confirming that the p...