cleantalk

Vulnerabilities and Security Researches

Recent vulnerability researches

CVE/PSC Application Date Affected versions Description
Actual on: Nov 13, 2026, 03:11:41

CVE-2026-125781

Event post

vulnerable

Nov 13, 2026, 08:11:18
Min -
Max 6.1.3
 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Stored XSS.This issue affects Event post: from n/a through 6.1.2.

CVE-2026-123668

Payment forms, Buy now buttons and Invoicing System | GetPaid

vulnerable

Nov 13, 2026, 03:11:19
Min 2.8.63
Max 2.8.65
 The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.

CVE-2026-110949

Download Manager

vulnerable

Nov 13, 2026, 03:11:10
Min -
Max 3.3.73
 The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-restricted package to obtain a download key and download the protected file.

CVE-2026-110948

Download Manager

vulnerable

Nov 13, 2026, 03:11:10
Min -
Max 3.3.73
 The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors to download password-locked and role-restricted files by reading the key from a public page.

CVE-2026-125435

PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)

vulnerable

Nov 13, 2026, 02:11:45
Min -
Max 3.1.4
 Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.

CVE-2026-106468

Code Snippets

vulnerable

Nov 13, 2026, 02:11:37
Min -
Max 4.1.0
 The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to create, overwrite and deactivate network-wide snippets belonging to the whole network.

CVE-2026-124411

WordPress Ecommerce For Creating Fast Online Stores – By SureCart

vulnerable

Nov 13, 2026, 02:11:31
Min -
Max 4.13.0
 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.

CVE-2026-123656

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

vulnerable

Nov 13, 2026, 02:11:22
Min -
Max 4.17.6
 The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection rule conditions when content is rendered outside the main query, allowing unauthenticated users to read the content of pages protected by such rules via the REST API.

CVE-2026-123657

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

vulnerable

Nov 13, 2026, 02:11:22
Min -
Max 4.17.6
 The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether a plan is active, allowing unauthenticated visitors to sign up for membership plans an administrator has deactivated and receive the role attached to them.

CVE-2026-123659

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

vulnerable

Nov 13, 2026, 02:11:22
Min -
Max 4.17.6
 The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accept to those configured by the administrator, allowing unauthenticated users to list accounts a directory was set to hide and to recover user meta values of listed users.

Recent approved applications

Application Date Description Details
Actual on: Nov 13, 2026, 03:11:41

TikTok

Oct 26, 2026, 19:10:22 Advertising integrations connect a WordPress site to external accounts and send selected website events to a marketing platform. TikTok version 1.4.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65711. The review focused on administrator access to connection settings, account credentials, pixel configuration, event data, remote requests, and safe presentation of service responses.

Show Current Template

Oct 26, 2026, 19:10:22 Template diagnostics expose theme and file information in the WordPress toolbar to help explain how a page was rendered. Show Current Template version 0.5.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65720. The review focused on toolbar visibility, user access, template and theme names, included file output, and escaping of diagnostic information.

SSL Insecure Content Fixer

Oct 26, 2026, 19:10:22 Mixed content correction changes resource URLs and page output so an HTTPS site can load its assets consistently. SSL Insecure Content Fixer version 2.7.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65717. The review focused on administrative settings, correction levels, HTTPS detection, content rewriting, multisite defaults, and safe output handling.

Page Links To

Oct 26, 2026, 19:10:22 Custom link destinations change where visitors go when they open a WordPress entry or follow its title. Page Links To version 3.4.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65715. The review focused on post editing permissions, destination URL validation, saved link metadata, redirect behavior, and output of replacement links.

Customizer Export/Import

Oct 26, 2026, 19:10:22 Theme settings migration processes uploaded configuration data and can replace values that control a live site appearance. Customizer Export/Import version 0.9.8 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65716. The review focused on Customizer permissions, export output, uploaded settings validation, theme compatibility, option import, and optional image handling.

Post Type Switcher

Oct 26, 2026, 19:10:22 Changing a post type can move existing content between editing workflows, templates, and publication controls. Post Type Switcher version 4.1.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65714. The review focused on editing permissions, target post type validation, individual and bulk changes, editor integration, and preservation of existing content.

Simple 301 Redirects by BetterLinks

Oct 26, 2026, 19:10:22 Redirect managers control how incoming URLs are routed and can change the destination of existing site traffic. Simple 301 Redirects by BetterLinks - Easy Redirect Manager version 2.1.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65719. The review focused on redirect management permissions, source and destination validation, wildcard rules, bulk import and export, and dashboard output.

Nginx Helper

Oct 26, 2026, 19:10:22 Cache management integrations connect WordPress publishing events to server cache purges and deployment specific routing rules. Nginx Helper version 2.4.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65713. The review focused on cache purge permissions, purge settings, URL handling, publishing events, Redis integration, and dashboard output.

IndexNow Plugin

Oct 26, 2026, 19:10:22 Search notification plugins transmit site URLs to indexing services when content is created, updated, or removed. IndexNow Plugin version 1.0.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65718. The review focused on submission permissions, API key handling, automatic publishing events, URL exclusions, manual requests, submission history, and external communication.

Microsoft Clarity

Oct 26, 2026, 19:10:22 Behavioral analytics integrations add tracking code and connect website activity to a remote reporting project. Microsoft Clarity version 0.10.37 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65712. The review focused on project configuration, permissions for analytics settings, tracking code output, integration data, and communication with Microsoft Clarity.