Vulnerabilities and Security Researches

Recent vulnerability researches
CVE/PSC	Application	Date	Affected versions	Description
			Actual on: Jul 29, 2026, 15:07:20
CVE-2026-27403	Hubbub Lite vulnerable	Jul 29, 2026, 20:07:06	Min - Max 1.36.3.1	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.
CVE-2026-15646	Brands for WooCommerce vulnerable	Jul 29, 2026, 19:07:57	Min - Max 3.8.8.1	The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-15647	Brands for WooCommerce vulnerable	Jul 29, 2026, 19:07:57	Min - Max 3.8.8.1	The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload is stored in term meta rather than post content, the WordPress unf...
CVE-2026-15648	Brands for WooCommerce vulnerable	Jul 29, 2026, 19:07:57	Min - Max 3.8.8.1	The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-15448	Tickera – WordPress Event Ticketing vulnerable	Jul 29, 2026, 19:07:42	Min - Max 3.6.0.2	The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive informatio...
CVE-2026-15761	Tickera – WordPress Event Ticketing vulnerable	Jul 29, 2026, 19:07:42	Min - Max 3.6.0.2	The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from ...
CVE-2026-27399	MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution vulnerable	Jul 29, 2026, 19:07:41	Min - Max 2.1.50	Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.
CVE-2026-65486	Event post vulnerable	Jul 29, 2026, 19:07:35	Min - Max 6.1.0	Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
CVE-2026-65562	BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support vulnerable	Jul 29, 2026, 19:07:34	Min - Max 4.7.0	Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.
CVE-2026-24628	Photo Gallery by Supsystic vulnerable	Jul 29, 2026, 19:07:28	Min - Max 1.16.3	Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.

Recent approved applications
Application	Date	Description	Details
			Actual on: Jul 29, 2026, 15:07:20
LiteSpeed Cache	Jul 28, 2026, 10:07:24	Caching and optimization plugins sit directly in the path that produces a public page. Their settings can influence stored output, asset delivery, and the content returned to every visitor. LiteSpeed Cache version 7.8.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64675, confirming that the plugin was reviewed from a secure code perspective with attention to cache isolation, purge controls, generated assets, optimization requests, and privileged settin...
Smush – Optimize, Compress and Lazy Load Images	Jul 28, 2026, 10:07:24	Image optimization plugins process files that become part of nearly every public page. Compression, format conversion, lazy loading, and CDN delivery all need careful handling of uploads, metadata, and generated URLs. Smush - Image Optimization, Compression, Lazy Load, WebP & CDN version 4.2.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64676, confirming that the plugin was reviewed from a secure code perspective with attention to image processing inp...
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress	Jul 28, 2026, 10:07:24	Form builders accept untrusted input from public visitors and turn it into stored records, notifications, and administrator workflows. Secure validation, permission checks, and careful output handling are central to every submission path. Ninja Forms - The Contact Form Builder That Grows With You version 3.14.11 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64678, confirming that the plugin was reviewed from a secure code perspective with attention to p...
Premium Addons for Elementor	Jul 28, 2026, 10:07:24	Elementor extension packs add widgets, templates, display rules, and dynamic output to the page builder. Because saved widget settings become public HTML, secure rendering and protected editor actions are essential. Premium Addons for Elementor - Powerful Elementor Templates & Widgets version 4.11.89 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64677, confirming that the plugin was reviewed from a secure code perspective with attention to widget config...
Translate Multilingual sites – TranslatePress	Jul 28, 2026, 10:07:24	Multilingual plugins store translated text and insert it into front-end output across themes and other plugins. Visual editing, language routing, and automatic translation features require firm access controls and consistent escaping. TranslatePress - Translate Multilingual sites with AI Translation version 3.2.6 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64679, confirming that the plugin was reviewed from a secure code perspective with attention to ...
Template Kit – Import	Jul 28, 2026, 10:07:24	Template import tools bring structured design data and assets into a WordPress installation. Import permissions, file validation, remote resources, and the safety of stored page content all matter before an imported kit reaches the public site. Template Kit - Import version 1.0.16 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64682, confirming that the plugin was reviewed from a secure code perspective with attention to import authorization, package val...
Intuitive Custom Post Order	Jul 28, 2026, 10:07:24	Content ordering plugins turn drag-and-drop administrator actions into persistent changes across posts, pages, taxonomies, and sites. Those updates must be limited to authorized objects and protected from forged requests. Intuitive Custom Post Order version 3.2.0 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64683, confirming that the plugin was reviewed from a secure code perspective with attention to reorder permissions, request integrity, object iden...
Honeypot for Contact Form 7	Jul 28, 2026, 10:07:24	Contact Form 7 extensions can influence spam checks, stored submissions, redirects, and outbound webhooks. These features cross the boundary between anonymous form input, privileged records, external destinations, and front-end responses. CF7 Apps - Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 version 3.6.1 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64684, confirming that the plugin was reviewed from a secure code perspecti...
WooCommerce Legacy REST API	Jul 28, 2026, 10:07:24	Commerce APIs expose structured access to products, orders, customers, and store operations. A compatibility plugin that restores legacy endpoints must enforce authentication and permissions consistently across every request. WooCommerce Legacy REST API version 1.0.5 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64680, confirming that the plugin was reviewed from a secure code perspective with attention to API authentication, request authorization, obje...
Jetpack – WP Security, Backup, Speed, & Growth	Jun 25, 2026, 16:06:39	Security and performance suites operate across many areas of a WordPress installation, including backups, malware scanning, content delivery, statistics, forms, and social publishing. That makes them operationally useful, but also security-sensitive because a broad plugin footprint can affect privileged settings, connected service tokens, public scripts, and administrator workflows. Jetpack - WP Security, Backup, Speed, and Growth version 15.9.1 has successfully completed the CleanTalk Plugin Security Certi...

Recent vulnerability researches

Recent approved applications