cleantalk

Vulnerabilities and Security Researches

Recent vulnerability researches

CVE/PSC Application Date Affected versions Description
Actual on: Oct 29, 2026, 00:10:16

CVE-2026-118169

Hustle – Email Marketing, Lead Generation, Optins, Popups

vulnerable

Oct 29, 2026, 04:10:30
Min -
Max 7.8.14.4
 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[cta_label]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default only Administrators hold the hustle_e...

CVE-2026-107710

Hustle – Email Marketing, Lead Generation, Optins, Popups

vulnerable

Oct 29, 2026, 04:10:30
Min -
Max 7.8.14.4
 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has expl...

CVE-2026-116398

Content Slider Block – Display slider in a beautiful way.

vulnerable

Oct 29, 2026, 04:10:12
Min -
Max 3.2.2
 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content Slider Block content-slider-block allows Stored XSS.This issue affects Content Slider Block: from n/a through 3.2.1.

CVE-2026-109972

s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscription

vulnerable

Oct 29, 2026, 03:10:03
Min -
Max 261017
 The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pag...

CVE-2026-107625

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &amp; Membership Plugin

vulnerable

Oct 29, 2026, 02:10:46
Min -
Max 2.14.1
 The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Suc...

CVE-2026-97019

AMP for WP &#8211; Accelerated Mobile Pages

vulnerable

Oct 29, 2026, 01:10:53
Min -
Max 1.1.18
 The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Subscriber-level user can store a malicious shortcode in their biographical info field; because WordPress...

CVE-2026-103319

OPay Payment Gateway for WooCommerce

vulnerable

Oct 29, 2026, 00:10:45
Min -
Max 2.5.5
 The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

CVE-2026-116761

CMB2

vulnerable

Oct 29, 2026, 00:10:42
Min -
Max 2.13.5
 The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when a site integrator renders the plug...

CVE-2026-115954

Geo Mashup

vulnerable

Oct 29, 2026, 00:10:08
Min -
Max 1.13.23
 Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.

CVE-2026-115953

Geo Mashup

vulnerable

Oct 29, 2026, 00:10:08
Min -
Max 1.13.23
 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through 1.13.22.

Recent approved applications

Application Date Description Details
Actual on: Oct 29, 2026, 00:10:16

TikTok

Oct 26, 2026, 19:10:22 Advertising integrations connect a WordPress site to external accounts and send selected website events to a marketing platform. TikTok version 1.4.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65711. The review focused on administrator access to connection settings, account credentials, pixel configuration, event data, remote requests, and safe presentation of service responses.

Show Current Template

Oct 26, 2026, 19:10:22 Template diagnostics expose theme and file information in the WordPress toolbar to help explain how a page was rendered. Show Current Template version 0.5.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65720. The review focused on toolbar visibility, user access, template and theme names, included file output, and escaping of diagnostic information.

SSL Insecure Content Fixer

Oct 26, 2026, 19:10:22 Mixed content correction changes resource URLs and page output so an HTTPS site can load its assets consistently. SSL Insecure Content Fixer version 2.7.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65717. The review focused on administrative settings, correction levels, HTTPS detection, content rewriting, multisite defaults, and safe output handling.

Page Links To

Oct 26, 2026, 19:10:22 Custom link destinations change where visitors go when they open a WordPress entry or follow its title. Page Links To version 3.4.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65715. The review focused on post editing permissions, destination URL validation, saved link metadata, redirect behavior, and output of replacement links.

Customizer Export/Import

Oct 26, 2026, 19:10:22 Theme settings migration processes uploaded configuration data and can replace values that control a live site appearance. Customizer Export/Import version 0.9.8 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65716. The review focused on Customizer permissions, export output, uploaded settings validation, theme compatibility, option import, and optional image handling.

Post Type Switcher

Oct 26, 2026, 19:10:22 Changing a post type can move existing content between editing workflows, templates, and publication controls. Post Type Switcher version 4.1.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65714. The review focused on editing permissions, target post type validation, individual and bulk changes, editor integration, and preservation of existing content.

Simple 301 Redirects by BetterLinks

Oct 26, 2026, 19:10:22 Redirect managers control how incoming URLs are routed and can change the destination of existing site traffic. Simple 301 Redirects by BetterLinks - Easy Redirect Manager version 2.1.2 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65719. The review focused on redirect management permissions, source and destination validation, wildcard rules, bulk import and export, and dashboard output.

Nginx Helper

Oct 26, 2026, 19:10:22 Cache management integrations connect WordPress publishing events to server cache purges and deployment specific routing rules. Nginx Helper version 2.4.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65713. The review focused on cache purge permissions, purge settings, URL handling, publishing events, Redis integration, and dashboard output.

IndexNow Plugin

Oct 26, 2026, 19:10:22 Search notification plugins transmit site URLs to indexing services when content is created, updated, or removed. IndexNow Plugin version 1.0.4 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65718. The review focused on submission permissions, API key handling, automatic publishing events, URL exclusions, manual requests, submission history, and external communication.

Microsoft Clarity

Oct 26, 2026, 19:10:22 Behavioral analytics integrations add tracking code and connect website activity to a remote reporting project. Microsoft Clarity version 0.10.37 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-65712. The review focused on project configuration, permissions for analytics settings, tracking code output, integration data, and communication with Microsoft Clarity.