cleantalk

Vulnerabilities and Security Researches

Recent vulnerability researches

CVE/PSC Application Date Affected versions Description
Actual on: Apr 20, 2026, 18:04:26

CVE-2026-4801

Page Builder Gutenberg Blocks – CoBlocks

vulnerable

Apr 20, 2026, 20:04:43
Min -
Max 3.1.17
The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via external iCal feed data in all versions up to, and including, 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations fetched from external iCal feeds in the Events block rendering function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access...

CVE-2026-2505

Categories Images

vulnerable

Apr 20, 2026, 18:04:32
Min -
Max 3.3.2
The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.1, via the 'z_taxonomy_image' shortcode. This is due to the shortcode rendering path passing attacker-controlled class input into a fallback image builder that concatenates HTML attributes without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that execute when users interact with the injec...

CVE-2026-2986

Contextual Related Posts

vulnerable

Apr 20, 2026, 17:04:42
Min -
Max 4.2.2
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-8615

CubeWP – All-in-One Dynamic Content Framework

vulnerable

Apr 20, 2026, 13:04:35
Min -
Max 1.1.27
The CubeWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cubewp_shortcode_taxonomy shortcode in all versions up to, and including, 1.1.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-1838

Hostel

vulnerable

Apr 20, 2026, 12:04:27
Min -
Max 1.1.7
The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVE-2026-0894

Content Blocks (Custom Post Widget)

vulnerable

Apr 20, 2026, 12:04:20
Min -
Max 3.4.1
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_block shortcode in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied values consumed from user-created content blocks. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-1559

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress

vulnerable

Apr 20, 2026, 10:04:41
Min -
Max 1.3.7
The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkin_place_id' parameter in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-1280

Frontend File Manager Plugin

vulnerable

Apr 20, 2026, 09:04:36
Min -
Max 23.5
The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated attackers to share arbitrary uploaded files via email by supplying a file ID. Since file IDs are sequential integers, attackers can enumerate all uploaded files on the site and exfiltrate sensitive data that was intended to be restricted to administrators ...

CVE-2025-57957

WooMS

vulnerable

Apr 20, 2026, 05:04:41
Min -
Max 9.12
Missing Authorization vulnerability in wpcraft WooMS wooms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooMS: from n/a through <= 9.12.

CVE-2026-0844

Simple User Registration

vulnerable

Apr 20, 2026, 05:04:38
Min -
Max 6.8
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.

Recent approved applications

Application Date Description Details
Actual on: Apr 20, 2026, 18:04:26

Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form,

Apr 16, 2026, 12:04:16 Elementor addon suites are security-relevant because they add a large amount of front-end rendering and stored widget configuration into WordPress. These plugins frequently process user-controlled strings (titles, labels, URLs, templates) and expose admin-side builders and settings that, if not defended correctly, can become paths to stored XSS, CSRF-driven configuration changes, privilege boundary issues, or information disclosure via misconfigured endpoints. Element Pack – Widgets, Templates & Addons for ...

Metform Elementor Contact Form Builder

Mar 30, 2026, 11:03:54 MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (v4.1.3) is a powerful drag-and-drop form builder plugin designed to extend Elementor with advanced form creation capabilities. It allows users to build complex forms such as contact forms, surveys, booking forms, payment forms, and more without writing code. Built for websites running on WordPress, MetForm integrates deeply into both frontend and backend workflows, handling user input, data storage, AJAX submissions, file uploads, a...

File Manager Pro &#8211; Filester

Mar 30, 2026, 11:03:47 File manager plugins are security-relevant by design because they provide direct filesystem access from wp-admin, including upload, download, edit, delete, and archive operations that normally require FTP or hosting panel access. If access control, request integrity, or path handling is weak, these features can become a shortcut to data exposure, site defacement, or availability impact. File Manager Pro – Filester version 2.0.2 has successfully completed the CleanTalk Plugin Security Certification process a...

Simple Author Box

Mar 30, 2026, 11:03:46 Author box plugins are security-relevant because they render user-controlled profile data across the site, often including author bio text, website links, and social profiles. If output encoding, access control, or request integrity is weak, these surfaces can become a path to stored XSS, unauthorized profile metadata exposure, or CSRF-driven settings changes. Simple Author Box version 2.59 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64639, confirming...

Customizable WordPress Gallery Plugin &#8211; Modula Image Gallery

Mar 30, 2026, 11:03:45 Gallery plugins are security-relevant because they render user-controlled presentation data (titles, captions, alt text, links) across public pages and often provide rich admin-side builders and lightbox features. If output handling, access control, or request integrity is weak, attackers can target stored XSS through captions or settings, force configuration changes via CSRF, or expose media metadata through misprotected endpoints. Modula Image Gallery – Photo Grid & Video Gallery version 2.14.22 has succe...

Speed Optimizer &#8211; The All-In-One WordPress Performance-Boosting Plugin

Mar 30, 2026, 11:03:43 Performance and caching plugins are security-relevant because they introduce high-impact configuration inside wp-admin and can directly affect availability and content delivery behavior. If access control, request integrity, or output handling is weak, attackers may force cache purges or mode changes via CSRF, expose sensitive diagnostics, or manipulate settings that change how pages and assets are cached and served. Speed Optimizer – The All-In-One Performance-Boosting Plugin version 7.7.7 has successfully...

MainWP Child &#8211; Securely Connects Sites to the MainWP WordPress Manager Dashboard

Mar 30, 2026, 10:03:54 MainWP Child – Securely Connects to the MainWP Dashboard (v6.0.5) is a WordPress plugin designed to establish a secure connection between individual WordPress sites and a self-hosted MainWP Dashboard. This architecture allows centralized management of multiple websites, including updates, backups, monitoring, and content administration. Built for websites running on WordPress, the plugin acts as a controlled communication bridge between managed sites and the MainWP Dashboard. Due to its role in remote man...

Spectra &#8211; WordPress Gutenberg Blocks

Mar 30, 2026, 09:03:54 Spectra Gutenberg Blocks (v2.19.21) is an advanced extension for the WordPress block editor (Gutenberg), providing over 30 customizable blocks, layout tools, templates, and UI components for building modern websites without coding. Designed for websites running on WordPress, Spectra enhances the native editor instead of replacing it, allowing users to build feature-rich pages while maintaining compatibility with WordPress core architecture. With over 1+ million active installations, Spectra operates at a ...

MalCare WordPress Security Plugin &#8211; Malware Scanner, Cleaner, Security Firewall

Mar 27, 2026, 11:03:54 Security plugins are uniquely sensitive in WordPress because they operate with high privilege, touch authentication and request filtering, and often integrate with external scanning and firewall services. If access control, request integrity, or output handling is weak, attackers may force configuration changes via CSRF, abuse endpoints to leak site security metadata, or inject malicious content into admin-facing reports. MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall versio...

Migrate Guru: Migrate &amp; Clone WordPress Free

Mar 27, 2026, 11:03:53 Migration plugins are security-relevant because they operate with high privilege, touch both the filesystem and the database, and often require sensitive destination details like FTP/cPanel credentials or a migration key. If access control, request integrity, or input/output handling is weak, attackers may trigger unauthorized migrations, leak migration metadata, force configuration changes via CSRF, or abuse migration logic to cause resource exhaustion. Migrate Guru – Site Migration & Cloning version 6.28 ...