Threat Entry Updated 2025-12-09

CVE-2025-13604 - Security Malware Firewall Plugin

The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Security Malware Firewall

CVE-2025-13604

HIGH CVSS 7.2 2025-12-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-26

CVE-2024-10570 - Security Malware Firewall Plugin

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function in all versions up to, and including, 2.145, as well as insufficient input sanitization and validation. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN Security Malware Firewall

CVE-2024-10570

HIGH CVSS 7.5 2024-11-26

Risk Score

Open Full Technical Breakdown