cleantalk

Vulnerabilities and Security Researches

Recent vulnerability researches

CVE/PSC Application Date Affected versions Description
Actual on: Nov 10, 2026, 03:11:09

CVE-2026-121775

CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce

vulnerable

Nov 10, 2026, 08:11:01
Min -
Max 2.2.21
 Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.

CVE-2026-122663

CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce

vulnerable

Nov 10, 2026, 08:11:01
Min -
Max 2.2.21
 Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.

CVE-2026-66669

Superb Addons – WordPress Editor Blocks & Patterns and Elementor Sections & Elements

vulnerable

Nov 10, 2026, 07:11:46
Min -
Max 4.2.5
 Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.

CVE-2026-123464

The Events Calendar

vulnerable

Nov 10, 2026, 07:11:46
Min -
Max 6.18.3.1
 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.3.

CVE-2026-123469

The Events Calendar

vulnerable

Nov 10, 2026, 07:11:46
Min -
Max 6.18.3.1
 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Code Injection.This issue affects The Events Calendar: from n/a through 6.18.3.

CVE-2026-120858

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder

vulnerable

Nov 10, 2026, 07:11:36
Min -
Max 6.2.17
 Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.16.

CVE-2026-123470

HivePress – Business Directory & Classified Ads WordPress Plugin

vulnerable

Nov 10, 2026, 07:11:35
Min -
Max 1.8.2
 Missing Authorization vulnerability in HivePress HivePress hivepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress: from n/a through 1.8.1.

CVE-2026-119489

WP Recipe Maker

vulnerable

Nov 10, 2026, 07:11:02
Min -
Max 10.9.2
 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures WP Recipe Maker wp-recipe-maker allows Stored XSS.This issue affects WP Recipe Maker: from n/a through 10.9.1.

CVE-2026-122060

WP Recipe Maker

vulnerable

Nov 10, 2026, 07:11:02
Min -
Max 10.9.2
 The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.

CVE-2026-119493

Ditty – Responsive News Tickers, Sliders, and Lists

vulnerable

Nov 10, 2026, 06:11:55
Min -
Max 3.1.72
 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations, LLC Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through 3.1.71.

Recent approved applications

Application Date Description Details
Actual on: Nov 10, 2026, 03:11:09

TikTok

Oct 26, 2026, 19:10:22 Advertising integrations connect a WordPress site to external accounts and send selected website events to a marketing platform. TikTok version 1.4.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65711. The review focused on administrator access to connection settings, account credentials, pixel configuration, event data, remote requests, and safe presentation of service responses.

Show Current Template

Oct 26, 2026, 19:10:22 Template diagnostics expose theme and file information in the WordPress toolbar to help explain how a page was rendered. Show Current Template version 0.5.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65720. The review focused on toolbar visibility, user access, template and theme names, included file output, and escaping of diagnostic information.

SSL Insecure Content Fixer

Oct 26, 2026, 19:10:22 Mixed content correction changes resource URLs and page output so an HTTPS site can load its assets consistently. SSL Insecure Content Fixer version 2.7.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65717. The review focused on administrative settings, correction levels, HTTPS detection, content rewriting, multisite defaults, and safe output handling.

Page Links To

Oct 26, 2026, 19:10:22 Custom link destinations change where visitors go when they open a WordPress entry or follow its title. Page Links To version 3.4.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65715. The review focused on post editing permissions, destination URL validation, saved link metadata, redirect behavior, and output of replacement links.

Customizer Export/Import

Oct 26, 2026, 19:10:22 Theme settings migration processes uploaded configuration data and can replace values that control a live site appearance. Customizer Export/Import version 0.9.8 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65716. The review focused on Customizer permissions, export output, uploaded settings validation, theme compatibility, option import, and optional image handling.

Post Type Switcher

Oct 26, 2026, 19:10:22 Changing a post type can move existing content between editing workflows, templates, and publication controls. Post Type Switcher version 4.1.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65714. The review focused on editing permissions, target post type validation, individual and bulk changes, editor integration, and preservation of existing content.

Simple 301 Redirects by BetterLinks

Oct 26, 2026, 19:10:22 Redirect managers control how incoming URLs are routed and can change the destination of existing site traffic. Simple 301 Redirects by BetterLinks - Easy Redirect Manager version 2.1.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65719. The review focused on redirect management permissions, source and destination validation, wildcard rules, bulk import and export, and dashboard output.

Nginx Helper

Oct 26, 2026, 19:10:22 Cache management integrations connect WordPress publishing events to server cache purges and deployment specific routing rules. Nginx Helper version 2.4.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65713. The review focused on cache purge permissions, purge settings, URL handling, publishing events, Redis integration, and dashboard output.

IndexNow Plugin

Oct 26, 2026, 19:10:22 Search notification plugins transmit site URLs to indexing services when content is created, updated, or removed. IndexNow Plugin version 1.0.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65718. The review focused on submission permissions, API key handling, automatic publishing events, URL exclusions, manual requests, submission history, and external communication.

Microsoft Clarity

Oct 26, 2026, 19:10:22 Behavioral analytics integrations add tracking code and connect website activity to a remote reporting project. Microsoft Clarity version 0.10.37 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65712. The review focused on project configuration, permissions for analytics settings, tracking code output, integration data, and communication with Microsoft Clarity.