Incsub vulnerabilities

Products

• Forminator 21
• Hummingbird 4
• Hustle 2

Newest

• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion CVE-2025-6464 7.5 HighJuly 2, 2025
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion CVE-2025-6463 EPSS 15.1% 8.8 HighJuly 2, 2025
• incsub hummingbird WordPress Hummingbird plugin <= 3.9.1 - Broken Access Control vulnerability CVE-2024-43118 4.3 MediumNovember 1, 2024
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +2 more Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation CVE-2024-10402 7.5 HighOctober 26, 2024
• incsub forminator Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this... CVE-2024-45625 6.1 MediumSeptember 9, 2024
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure CVE-2024-7389 7.5 HighAugust 2, 2024
• incsub hummingbird WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerability CVE-2024-32792 4.3 MediumJune 9, 2024
• incsub forminator, wpmudev broken link checker +1 more Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type... CVE-2024-28890 5.3 MediumApril 23, 2024
• incsub forminator Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is... CVE-2024-31077 EPSS 30.4% 7.2 HighApril 23, 2024
• incsub forminator Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability... CVE-2024-31857 5.4 MediumApril 23, 2024
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload CVE-2024-1794 7.2 HighApril 9, 2024
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode CVE-2024-3053 6.4 MediumApril 9, 2024
• incsub forminator WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-29777 7.1 HighMarch 27, 2024
• incsub forminator Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting CVE-2023-5119 4.8 MediumNovember 20, 2023
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload CVE-2023-6133 6.6 MediumNovember 15, 2023
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload CVE-2023-4596 Public exploit EPSS 14.3% 9.8 CriticalAugust 30, 2023
• incsub forminator Forminator < 1.24.4 - Reflected XSS CVE-2023-3134 6.1 MediumJuly 31, 2023
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass CVE-2021-4417 5.4 MediumJuly 12, 2023
• incsub forminator Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote CVE-2023-2010 3.1 LowJuly 4, 2023
• incsub hummingbird Hummingbird < 3.4.2 - Unauthenticated Path Traversal CVE-2023-1478 9.8 CriticalApril 10, 2023
• incsub forminator WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-36821 7.1 HighMarch 16, 2023
• incsub hummingbird, unknown hummingbird – optimize speed, enable cache, minify css & defer critical js +1 more Hummingbird < 3.3.2 - Admin+ Stored Cross-Site Scripting CVE-2022-0994 4.8 MediumApril 18, 2022
• incsub forminator, unknown forminator – contact form, payment form & custom form builder +1 more Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting CVE-2021-24700 4.8 MediumNovember 23, 2021
• incsub hustle The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to... CVE-2018-18576 5.3 MediumMarch 17, 2020
• incsub buddypress-activity-plus The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory... CVE-2015-9455 8.1 HighOctober 7, 2019
• incsub hustle The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it... CVE-2019-11872 8.8 HighMay 29, 2019
• incsub forminator The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL... CVE-2019-9568 6.5 MediumMarch 4, 2019
• incsub forminator The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a... CVE-2019-9567 6.1 MediumMarch 4, 2019