PT-2025-49799 · WordPress · Cleantalk

Angus Girvan · Published 2025-12-09 · Updated 2025-12-14 · CVE-2025-13604

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CleanTalk plugin for WordPress versions prior to 2.169

Description The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to the page URL. This allows unauthenticated attackers to inject arbitrary web scripts into pages. When a user accesses an injected page, the scripts will execute.

Recommendations Update the CleanTalk plugin to version 2.169 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13604

Affected Products

Cleantalk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-13604 · Security Note
• https://plugins.trac.wordpress.org/browser/security-malware-firewall/tags/2.168/inc/spbc-settings.php#L2342 · Note
• https://twitter.com/CVEnew/status/1998355367278022815 · Twitter Post
• https://twitter.com/cracbot/status/2000158895122288773 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/1e35eb83-716e-4177-99ba-24a884725265?source=cve · Note