cleantalk

Vulnerabilities and Security Researches

Recent vulnerability researches

CVE/PSC Application Date Affected versions Description
Actual on: Oct 14, 2026, 03:10:06

CVE-2026-103080

Boost Sales for WooCommerce – Set up Up-Sells & Cross-Sells Popups & Auto Apply Coupon

vulnerable

Oct 14, 2026, 07:10:55
Min -
Max 1.3.1
 External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.

CVE-2026-108479

Patreon WordPress

vulnerable

Oct 14, 2026, 07:10:54
Min -
Max 1.10.0
 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.

CVE-2026-108481

Patreon WordPress

vulnerable

Oct 14, 2026, 07:10:54
Min -
Max 1.11.0
 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.

CVE-2026-108475

Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP

vulnerable

Oct 14, 2026, 07:10:51
Min -
Max 7.3.7
 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6.

CVE-2026-106605

Flexible Quantity – Measurement Price Calculator for WooCommerce

vulnerable

Oct 14, 2026, 07:10:26
Min -
Max 2.3.23
 Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.

CVE-2026-84167

Hotel Booking

vulnerable

Oct 14, 2026, 07:10:23
Min -
Max 3.8
 The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

CVE-2026-84166

Hotel Booking

vulnerable

Oct 14, 2026, 07:10:23
Min -
Max 3.8
 The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.

CVE-2026-84734

Mindstien Quick Login

vulnerable

Oct 14, 2026, 04:10:47
Min -
Max 1.0
 The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.

CVE-2026-89305

paymendo – Bank Transfer (Lite)

vulnerable

Oct 14, 2026, 04:10:32
Min -
Max 1.1
 The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

CVE-2026-89304

paymendo – Bank Transfer (Lite)

vulnerable

Oct 14, 2026, 04:10:32
Min -
Max 1.1
 The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.

Recent approved applications

Application Date Description Details
Actual on: Oct 14, 2026, 03:10:06

Disable XML-RPC

Sep 25, 2026, 12:09:44 XML-RPC controls affect remote publishing clients and other integrations that communicate with WordPress through the XML-RPC endpoint. Disable XML-RPC version 1.0.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65709. The review focused on plugin bootstrap behavior, filter registration, XML-RPC availability, activation state, compatibility with the WordPress request path, and the absence of unnecessary user input surfaces.

Widget Importer & Exporter

Sep 25, 2026, 12:09:44 Widget migration tools process configuration data that can create or update active and inactive widget instances across a WordPress site. Widget Importer & Exporter version 1.6.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65707. The review focused on upload handling, JSON data validation, administrator permissions, widget instance import, export output, duplicate detection, unsupported widgets, and developer hooks.

Instant Indexing for Google

Sep 25, 2026, 12:09:44 Search submission plugins handle site URLs and service credentials while sending manual or automatic requests to external indexing endpoints. Instant Indexing for Google version 1.1.22 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65710. The review focused on settings permissions, credential handling, URL validation, manual and bulk submissions, automatic post events, remote API requests, response output, post type exclusions, and IndexNow controls.

Simple Cloudflare Turnstile – CAPTCHA Alternative

Sep 25, 2026, 12:09:44 Anti-spam integrations accept challenge tokens on public forms and exchange them with an external verification service before a submission is allowed. Simple CAPTCHA with Cloudflare Turnstile version 1.43.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65708. The review focused on settings permissions, key handling, challenge token validation, server side verification, form integration, whitelisting, failsafe behavior, and diagnostic logging.

AMP

Sep 22, 2026, 11:09:27 AMP integrations transform WordPress output, validate generated markup, and may direct visitors between standard and optimized page variants. AMP version 2.5.5 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65701. The review focused on administrative settings, markup sanitization, validation data, template processing, component handling, and safe page delivery.

Converter for Media – Optimize images | Convert WebP & AVIF

Sep 22, 2026, 11:09:27 Image optimization plugins read files from the uploads directory, create alternative formats, and route visitor requests to generated assets. Converter for Media - Optimize images | Convert WebP & AVIF version 6.6.5 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65700. The review focused on source file validation, path confinement, conversion jobs, generated output, delivery rules, and permission checks around administrative actions.

WP Crontrol

Sep 22, 2026, 11:09:27 Cron management plugins can inspect, create, pause, delete, and immediately execute scheduled tasks that affect many parts of a WordPress site. WP Crontrol version 1.21.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65702. The review focused on authorization for event management, request integrity, callback and argument display, custom schedules, URL validation, bulk actions, and exported event data.

Child Theme Configurator

Sep 18, 2026, 11:09:14 Child theme utilities inspect installed themes and can create or modify PHP, CSS, and configuration files inside the WordPress themes directory. Child Theme Configurator version 2.6.7 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65697. The review focused on administrative authorization, filesystem boundaries, theme and file selection, stylesheet parsing, template copying, and safe handling of configuration input.

Health Check & Troubleshooting

Aug 25, 2026, 23:08:42 Diagnostic plugins inspect server and WordPress configuration, collect debug data, verify files and email delivery, and alter plugin or theme state for a troubleshooting session. Health Check & Troubleshooting version 1.7.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64692, confirming that the review focused on privileged diagnostics, session isolation, debug data disclosure, file integrity checks, tool requests, and temporary troubleshooting controls...

Limit Login Attempts

Aug 25, 2026, 23:08:42 Login protection plugins operate directly on authentication requests, retry counters, lockouts, cookies, client addresses, and administrative notifications. Limit Login Attempts version 1.7.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64690, confirming that the review focused on retry tracking, IP handling, lockout enforcement, authentication cookie checks, configuration access, and safe logging of failed attempts.