Vulnerabilities and Security Researches

Recent vulnerability researches
CVE/PSC	Application	Date	Affected versions	Description
			Actual on: Sep 04, 2026, 18:09:03
CVE-2026-81292	Simple Payment vulnerable	Sep 04, 2026, 22:09:37	Min - Max 2.5.2	Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
CVE-2026-84773	EWWW Image Optimizer vulnerable	Sep 04, 2026, 22:09:27	Min - Max 8.7.7	Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
CVE-2026-82884	All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic vulnerable	Sep 04, 2026, 22:09:20	Min - Max 5.0.0.1	The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privileged user edits the post.
CVE-2026-81294	Authorizer vulnerable	Sep 04, 2026, 21:09:54	Min - Max 3.15.2	Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
CVE-2026-84781	Gallery PhotoBlocks vulnerable	Sep 04, 2026, 21:09:49	Min - Max 1.3.5	Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
CVE-2026-85303	Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently \| WordPress plugin vulnerable	Sep 04, 2026, 21:09:33	Min - Max 2.7.8	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.
CVE-2026-84812	Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss vulnerable	Sep 04, 2026, 21:09:19	Min - Max 2.15.28	Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
CVE-2026-12865	Photo Gallery by 10Web – Mobile-Friendly Image Gallery vulnerable	Sep 04, 2026, 21:09:02	Min - Max 1.8.44	The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders on...
CVE-2026-84761	LiteSpeed Cache vulnerable	Sep 04, 2026, 21:09:00	Min - Max 7.9.1	Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.
CVE-2026-84762	WP EasyPay – Square for WordPress vulnerable	Sep 04, 2026, 21:09:00	Min - Max 4.5.4	Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.

Recent approved applications
Application	Date	Description	Details
			Actual on: Sep 04, 2026, 18:09:03
Health Check & Troubleshooting	Aug 25, 2026, 23:08:42	Diagnostic plugins inspect server and WordPress configuration, collect debug data, verify files and email delivery, and alter plugin or theme state for a troubleshooting session. Health Check & Troubleshooting version 1.7.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64692, confirming that the review focused on privileged diagnostics, session isolation, debug data disclosure, file integrity checks, tool requests, and temporary troubleshooting controls...
Limit Login Attempts	Aug 25, 2026, 23:08:42	Login protection plugins operate directly on authentication requests, retry counters, lockouts, cookies, client addresses, and administrative notifications. Limit Login Attempts version 1.7.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64690, confirming that the review focused on retry tracking, IP handling, lockout enforcement, authentication cookie checks, configuration access, and safe logging of failed attempts.
Force Regenerate Thumbnails	Aug 25, 2026, 23:08:42	Thumbnail regeneration tools delete derived image sizes, read original uploads, create replacement files, and execute batch operations across the media library. Force Regenerate Thumbnails version 2.3.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64694, confirming that the review focused on attachment authorization, path confinement, batch requests, file deletion scope, image processing inputs, and progress handling.
Advanced Google reCAPTCHA	Aug 25, 2026, 23:08:42	CAPTCHA integrations sit on public login, registration, password reset, comment, commerce, and community forms where untrusted requests meet account and content workflows. Advanced Google reCAPTCHA version 5.40 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64693, confirming that the review focused on token verification, protected form coverage, settings authorization, remote API handling, bypass resistance, and safe failure behavior.
Complianz – Terms and Conditions	Aug 25, 2026, 23:08:42	Legal document generators collect business and website details, store wizard answers, publish generated pages, and may process consumer withdrawal submissions. Complianz - Terms and Conditions version 1.4.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64691, confirming that the review focused on wizard permissions, stored configuration, document output, withdrawal form requests, email handling, anti-abuse controls, and safe rendering of generated text.
Site Kit by Google – Analytics, Search Console, AdSense, Speed	Aug 25, 2026, 00:08:21	Analytics and advertising integrations connect a WordPress dashboard to external services and expose site performance data to privileged users. Site Kit by Google - Analytics, Search Console, AdSense, Speed version 1.186.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64685, confirming that the review focused on service connections, dashboard data access, REST requests, administrator actions, and safe rendering of remote metrics.
Disable Comments – Remove Comments & Stop Spam [Multi-Site Support]	Aug 25, 2026, 00:08:21	Comment management tools affect public submission paths, administration screens, feeds, APIs, and multisite policy. Disable Comments - Remove Comments & Stop Spam [Multi-Site Support] version 2.8.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64686, confirming that the review focused on settings access, request validation, comment-related endpoints, role-aware controls, and consistent enforcement across supported site contexts.
Admin Menu Editor	Aug 25, 2026, 00:08:21	Dashboard customization tools influence navigation, capability checks, menu visibility, redirects, and access to administrative screens. Admin Menu Editor version 1.15.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64688, confirming that the review focused on settings authorization, capability handling, menu configuration integrity, redirect behavior, and safe processing of custom labels, URLs, and icons.
WebP Express	Aug 25, 2026, 00:08:21	Image conversion plugins process uploaded files, write derivatives, update rewrite rules, and may invoke local or remote converters. WebP Express version 0.25.15 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64689, confirming that the review focused on file access, conversion inputs, generated output paths, rewrite behavior, converter configuration, and protection of privileged settings.
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress	Jul 28, 2026, 10:07:24	Form builders accept untrusted input from public visitors and turn it into stored records, notifications, and administrator workflows. Secure validation, permission checks, and careful output handling are central to every submission path. Ninja Forms - The Contact Form Builder That Grows With You version 3.14.11 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64678, confirming that the plugin was reviewed from a secure code perspective with attention to p...

Recent vulnerability researches

Recent approved applications