TrustPulse: same CDN leak as OptinMonster

TrustPulse is a social-proof widget. Like other Awesome Motive products, its script often loads from a vendor CDN. That is invisible day to day — until the CDN is poisoned.

In June 2026 Sansec described an Awesome Motive CDN attack covering OptinMonster, TrustPulse and PushEngage. One upstream file change fans out to every site that embeds it.

The public write-up called out hosts like a.trstplse.com. If your homepage still loads that host, you remain on the same trust path.

The payload waited for a logged-in WordPress admin, then could create rogue admins and install a hiding backdoor plugin. Plugin updates alone were not the whole story.

Orb44 checks only the public homepage against that CDN catalog. No admin login. Red or green for that narrow question.

Check: orb44.com/trustpulse. Related: OptinMonster, PushEngage. Source: Sansec.

In plain terms: answer one clear question about your storefront first, then decide if you need a longer review. A one-minute check beats a week of guessing.

Keep the bar honest. A green result on a narrow check is not a forever-safe certificate. It only says what we saw on the public page we fetched right now.

If the result is red, fix the concrete thing first — the script, the open side door, the listing — then re-check. Screenshots into the admin chat work better than vague worry.

Share the checker link with whoever actually owns the site. Owners search symptoms. Admins need a binary answer they can act on today.

In plain terms: answer one clear question about your storefront first, then decide if you need a longer review. A one-minute check beats a week of guessing.

Keep the bar honest. A green result on a narrow check is not a forever-safe certificate. It only says what we saw on the public page we fetched right now.

If the result is red, fix the concrete thing first — the script, the open side door, the listing — then re-check. Screenshots into the admin chat work better than vague worry.

Share the checker link with whoever actually owns the site. Owners search symptoms. Admins need a binary answer they can act on today.

In plain terms: answer one clear question about your storefront first, then decide if you need a longer review. A one-minute check beats a week of guessing.

Keep the bar honest. A green result on a narrow check is not a forever-safe certificate. It only says what we saw on the public page we fetched right now.