CleanTalk's blog

Tag: wordPress plugins

Klaviyo Web Forms Spam Protection
CleanTalk added spam protection for Klaviyo web forms using direct form integration. So in case, you prefer using Klaviyo web forms be sure to use the most effective Anti-Spam plugin. Read the guide below and learn 4 steps to protect your Klaviyo web forms from spam.

Once the CleanTalk Anti-Spam plugin is installed it starts to protect all of the existing forms on your WordPress website. It may not only be Klaviyo web forms but also many others.

Download CleanTalk Anti-Spam plugin | Download Klaviyo

How to install CleanTalk Anti-Spam plugin

To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

After installing the plugin, click the «Activate»‎ button.

After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

That’s it! From now you How to completely protect your Klaviyo web forms from spam.

How to check spam protection for Klaviyo web forms

You can test the work of Anti-Spam protection for your СonvertKit Forms by using a test email s @ cleantalk.org (without spaces). First, open the form in an Incognito browser tab. Fill in all the required form fields and send a form. After submitting the form, you will see a block message about the block on the form submission.

2

If you have any questions, add a comment and we will be happy to help you.

Create your CleanTalk account – Register now and protect your СonvertKit Forms from spam in 5 minutes

Update

The protection works only for website visitors, not for website admins. Be sure to test the form protection using Incognito mode.

Additional features
- CleanTalk protects all forms at once: comments, registrations, feedbacks, contacts, reviews.
- Installation takes about 1-2 minutes.
- Smart 99% protection against spambots.
- Always online – 24/7 technical support.
- Logs, SpamFireWall, personal lists, country filters, stop-words, and many others.
Discover the complete list of CleanTalk Anti-Spam plugin features here.
August 5, 2024
CleanTalk Research Team Discovers Stored XSS Vulnerability in WP SEOPress Plugin (v7.7.1)
The CleanTalk Research Team identified a critical Stored XSS (Cross-Site Scripting) vulnerability in the WP SEOPress plugin, version 7.7.1. This flaw can be exploited by attackers with contributor privileges to create new admin accounts, potentially granting them full control of your WordPress website.

Understanding Stored XSS (CVE-2024-4899)

Stored XSS vulnerabilities allow attackers to inject malicious scripts directly into your website’s database. These scripts are then executed whenever someone views the compromised content. Unlike reflected XSS, user interaction isn’t required to trigger the attack, making it particularly dangerous.

How Attackers Can Exploit This Vulnerability

An attacker with contributor privileges can exploit this vulnerability by injecting malicious JavaScript code into the “SEO Title” field while creating a new post. This code can then be used to create a new admin account, granting them complete control over your website.

Potential Consequences of an Exploit
- Complete Site Takeover: Attackers could create new admin accounts and seize full control of your website.
- Data Theft: Sensitive information like user credentials, financial records, and even your website’s content could be stolen.
- Website Defacement: Attackers could alter the appearance of your site, inject further malicious code, or display unauthorized content.
- Persistent Backdoors: Malicious actors might install backdoors to ensure continued access even after the initial vulnerability is patched.
Taking Action to Secure Your Website
1. Update Immediately: The most critical step is to update the WP SEOPress plugin to the latest version as soon as possible. This update addresses the vulnerability and safeguards your website.
2. Review User Roles: Carefully review user roles and permissions. Contributors should have the minimum access necessary for their tasks.
Through continuous vulnerability discovery and disclosure, we empower website owners and developers to take preventative measures. We believe that by working together, we can create a robust and secure WordPress ecosystem for everyone.

Stay vigilant. Stay secure.
July 4, 2024
Critical Vulnerability Discovered in Gutenberg Blocks by Kadence Blocks Plugin
Our team at CleanTalk prioritizes the safety and security of the WordPress ecosystem. Through routine security testing, we’ve identified a critical vulnerability in the Gutenberg Blocks by Kadence Blocks plugin. This flaw poses a serious threat to WordPress websites, as it allows attackers to inject malicious code and potentially gain complete control.

Understanding the Threat (CVE-2024-4057)

This vulnerability, classified as Stored XSS (Cross-Site Scripting), enables attackers to embed malicious scripts directly into your website’s content. Unlike some vulnerabilities, Stored XSS doesn’t require user interaction to be triggered. This means anyone visiting your site, not just administrators, could be exposed.

Potential Consequences of an Exploit
- Complete Site Takeover: Attackers could create new admin accounts and seize full control of your website.
- Data Theft: Sensitive information like user credentials, financial records, and even your website’s content could be stolen.
- Website Defacement: Attackers could alter the appearance of your site, inject further malicious code, or display unauthorized content.
- Persistent Backdoors: Malicious actors might install backdoors to ensure continued access even after the initial vulnerability is patched.
Taking Action to Secure Your Website

The most critical step is to update the Gutenberg Blocks by Kadence Blocks plugin to the latest version immediately. This update addresses the vulnerability and safeguards your website.

CleanTalk’s Commitment to WordPress Security

At CleanTalk, we are relentless in our pursuit of discovering and disclosing vulnerabilities to protect the WordPress community. We strongly encourage all website owners to prioritize regular security updates and implement additional security measures like:
- Regular Vulnerability Scans: Proactive scanning helps identify and address potential threats before they are exploited.
- Least Privilege Principle: Grant users only the permissions necessary for their roles to minimize damage in case of a compromise.
- Security Plugins: Consider using security plugins that offer features like malware scanning, firewalls, and real-time threat monitoring.
By working together, we can create a safer and more secure WordPress ecosystem for everyone.

Stay vigilant. Stay secure.
June 24, 2024
Strengthen Your WordPress Security with Built-in Vulnerability Checks by CleanTalk
The CleanTalk Security plugin now offers built-in plugin vulnerability checks, empowering you to safeguard your WordPress website proactively. Just a friendly reminder if you haven’t try it till now: feel free to pick up the plugin and install it according to these instructions.

While plugins add valuable functionality, they can also introduce security risks if vulnerabilities exist. To address this, CleanTalk regularly scans popular plugins and integrates the findings directly into the Security plugin.

Here’s how it benefits you:
- Real-time Vulnerability Insights: Get notified within the plugin itself whenever potential vulnerabilities are detected in your active plugins.
- Proactive Security Measures: Take immediate action to address vulnerabilities and minimize the risk of attacks.
- Simplified Security Management: No need to visit external platforms for vulnerability information; it’s all accessible within the plugin.
This integration strengthens your WordPress security by informing you about potential threats and allowing you to take immediate action.

Stay Updated, Stay Secure!

The CleanTalk Security plugin continues to evolve, offering comprehensive security solutions for your WordPress site. Remember to update the plugin to benefit from the latest features and vulnerability checks.
May 27, 2024
Critical Security Vulnerability in Shortcode Ultimate Plugin for WordPress

During routine plugin testing, we discovered a critical security vulnerability in the Shortcodes Ultimate plugin for WordPress which has 600,000+ installations. This plugin, widely used for adding powerful shortcodes to enhance website functionality, is currently vulnerable to a severe security flaw that could potentially allow attackers to exploit and gain unauthorized access to your WordPress site.

The exploit allows contributors to embed malware JavaScript code into new posts via shortcode, subsequently facilitating admin account creation. By exploiting this flaw, attackers can gain unauthorized access and wreak havoc on websites.

Vulnerability detailed CVE on WPScan: https://wpscan.com/vulnerability/9eef8b29-2c62-4daa-ae90-467ff9be18d8.

How to secure your site from the vulnerability

Don’t rush to delete the plugin. To mitigate the risk you should just update your Shortcodes Ultimate plugin to the latest version. Additionally, implementing robust security measures, such as regular vulnerability assessments and user role restrictions, can fortify defenses against XSS attacks.

May 17, 2024
Revealing Vulnerabilities: The All-in-One SEO Plugin Dilemma

In the expansive domain of WordPress, a critical security flaw has been unveiled within the widely-utilized All-in-One SEO plugin. Known by its identifier, CVE-2024-3368, this vulnerability exposes a concerning loophole that malicious actors can exploit through Stored Cross-Site Scripting (XSS) attacks, jeopardizing the security of numerous websites. The trouble concerns all versions of All-in-One SEO older than 4.6.1.1.

This flaw was unearthed during routine security evaluations, shedding light on a troubling scenario where unauthorized individuals can inject harmful JavaScript code directly into WordPress posts. This unauthorized access allows for the manipulation of administrative privileges, potentially leading to serious repercussions such as website tampering and unauthorized data access.

In response to this alarming revelation, immediate action is crucial. WordPress website owners are strongly advised to promptly update their All-in-One SEO plugin to the latest version, fortified with patches to address this vulnerability. Furthermore, implementing stringent security measures, including regular audits and access controls, is essential to mitigate the risk of exploitation.

Behind the scenes, CleanTalk remains dedicated to safeguarding the WordPress ecosystem. Through vigilant monitoring of plugins and the provision of timely alerts, CleanTalk aims to empower website owners with the necessary tools and knowledge to defend against cyber threats effectively and preserve the integrity of their digital platforms.

May 13, 2024
We have added a new feature to Security Protection – File System Watcher

Introducing File System Watcher, a new feature of our Security protection. It helps to track changes in your site files to detect suspicious ones in time. File System Watcher has already been added to all plans and is enabled by default.

How the feature works

The feature takes a snapshot of the file system during a selected period and allows you to monitor which files on your site have been modified between selected dates. The snapshots are stored for 7 days.

You can control the frequency of snapshots in the plugin settings. Alternatively, you can run the snapshot immediately by clicking the Create File System snapshot button and refreshing the page.

How to use the feature and see results

1. Go to your WordPress site dashboard and go to Settings → Security by CleanTalk → File System Watcher.

2. Select the dates you want to compare and click the Compare button.

3. Click the View link and you will see the code for the modified version of the specified file.

To use this feature you have to have a Security & Malware scan plugin installed to your WordPress. Feel free to download it in WordPress catalog.

March 28, 2024
FluentBooking spam protection for WordPress

CleanTalk added spam protection for FluentBooking using direct form integration. Always be sure to use the most effective Anti-Spam plugin. For example CleanTalk Anti-Spam will guarantee your FluentBooking spam protection in about 5 minutes.

Once the CleanTalk Anti-Spam plugin is installed it starts to protect all of the existing forms on your WordPress website. It may not only be FluentBooking but many other forms.

Download CleanTalk Anti-Spam plugin | Download FluentBooking

How to install CleanTalk Anti-Spam plugin

To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

After installing the plugin, click the «Activate»‎ button.

After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

That’s it! From now your WordPress website and FluentBooking are protected from spam.

You can always use our detailed installation instructions.

How to check your FluentBooking spam protection in about 5 minutes

You can test the work of Anti-Spam protection for your FluentBooking forms by using a test email s @ cleantalk.org (without spaces). First, open the form in an Incognito browser tab. Fill in all the required form fields and send a form. After submitting the form, you will see a block message about the block on the form submission.

If you have any questions, add a comment and we will be happy to help you. Create your Cleantalk account – Register now and enjoy your spam-free FluentBooking.

You may view a complete list of CleanTalk Anti-Spam plugin features here. https://cleantalk.org/help/introduction

WordPress spam protection

March 20, 2024
Divi spam protection for WordPress
CleanTalk added spam protection for Divi Builder email opt-in subscription form using direct form integration. So in case, you prefer using Divi subscription form be sure to use the most effective Anti-Spam plugin. Read the guide below and learn 4 steps to protect your Divi subscription form from spam.

Once the CleanTalk Anti-Spam plugin is installed it starts to protect all of the existing forms on your WordPress website. It may not only be Newsletters subscription forms but also many others.

Download CleanTalk Anti-Spam plugin | Download Divi Builder email opt-in

How to install CleanTalk Anti-Spam plugin

To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

After installing the plugin, click the «Activate»‎ button.

After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

That’s it! From now you How to completely protect your Divi Builder email opt-in subscription form from spam.

How to check spam protection for Divi Builder email opt-in

You can test the work of Anti-Spam protection for your СonvertKit Forms by using a test email s @ cleantalk.org (without spaces). First, open the form in an Incognito browser tab. Fill in all the required form fields and send a form. After submitting the form, you will see a block message about the block on the form submission.

If you have any questions, add a comment and we will be happy to help you.

Create your CleanTalk account – Register now and protect your Divi Builder email opt-in from spam in 5 minutes

Update

The protection works only for website visitors, not for website admins. Be sure to test the form protection using Incognito mode.

Additional features
- CleanTalk protects all forms at once: comments, registrations, feedbacks, contacts, and reviews.
- Installation takes about 1-2 minutes.
- Smart 99% protection against spambots.
- Always online – 24/7 technical support.
- Logs, SpamFireWall, personal lists, country filters, stop-words, and many others.
Discover the complete list of CleanTalk Anti-Spam plugin features here.
March 14, 2024
Tribulant Newsletters spam protection for WordPress
CleanTalk added spam protection for Tribulant Newsletters using direct form integration. So in case, you prefer using Tribulant Newsletters be sure to use the most effective Anti-Spam plugin. Read the guide below and learn 4 steps to protect your Newsletters from spam.

Once the CleanTalk Anti-Spam plugin is installed it starts to protect all of the existing forms on your WordPress website. It may not only be Newsletters subscription forms but also many others.

Download CleanTalk Anti-Spam plugin | Download Tribulant Newsletters

How to install CleanTalk Anti-Spam plugin

To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

After installing the plugin, click the «Activate»‎ button.

After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

That’s it! From now you How to completely protect your Tribulant Newsletters from spam.

How to check spam protection for Tribulant Newsletters

You can test the work of Anti-Spam protection for your СonvertKit Forms by using a test email s @ cleantalk.org (without spaces). First, open the form in an Incognito browser tab. Fill in all the required form fields and send a form. After submitting the form, you will see a block message about the block on the form submission.

If you have any questions, add a comment and we will be happy to help you.

Create your CleanTalk account – Register now and protect your Tribulant Newsletters from spam in 5 minutes

Update

The protection works only for website visitors, not for website admins. Be sure to test the form protection using Incognito mode.

Additional features
- CleanTalk protects all forms at once: comments, registrations, feedbacks, contacts, reviews.
- Installation takes about 1-2 minutes.
- Smart 99% protection against spambots.
- Always online – 24/7 technical support.
- Logs, SpamFireWall, personal lists, country filters, stop-words, and many others.
Discover the complete list of CleanTalk Anti-Spam plugin features here.
March 14, 2024

CleanTalk

Sign up / Sign in

Solutions

Anti-Spam for websitee

Filter fake emails

Hide contact data

Stop spam emails in Contact form 7 (CF7)

Stop spam in Elementor form builder

Stop spam in WPForms

Website malware scanner

WordPress Security & Firewall Plugin

Documentation

License agreement

Signs of Malware

Contact us

Create a support ticket