Wpmudev vulnerabilities

Products

• Forminator Forms – Contact Form, Payment Form & Custom Form Builder 37
• Forminator Forms 10
• Hustle – Email Marketing, Lead Generation, Optins, Popups 8
• Defender Security 7
• Branda – White Label & Branding, Free Login Page Customizer 5
• Broken Link Checker 5
• Branda 4
• Defender 4
• Smartcrawl Seo Checker, Analyzer & Optimizer 4
• Broken Link Checker 3
• Hustle 3
• Smartcrawl 3
• Custom Sidebars 2
• Smush Image Compression And Optimization 2
• Wpmu Dev Dashboard 2

Newest

• wpmudev hustle – email marketing, lead generation, optins, popups Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX… CVE-2026-109386 4.3 MediumOctober 31, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter CVE-2026-97638 7.5 HighOctober 30, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata CVE-2026-5461 6.5 MediumOctober 30, 2026
• wpmudev hustle – email marketing, lead generation, optins, popups Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter CVE-2026-118169 4.9 MediumOctober 28, 2026
• wpmudev hustle – email marketing, lead generation, optins, popups Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title CVE-2026-107710 6.4 MediumOctober 28, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block CVE-2026-103911 6.5 MediumOctober 16, 2026
• wpmu dev - your all-in-one wordpress platform broken link checker Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback CVE-2026-96562 6.5 MediumOctober 16, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags CVE-2026-101335 6.5 MediumOctober 16, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter CVE-2026-92144 7.2 HighOctober 1, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field CVE-2026-85235 7.2 HighOctober 1, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter CVE-2026-92229 Public exploit 9.1 CriticalSeptember 19, 2026
• wpmudev hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdn Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log CVE-2026-83627 9.8 CriticalSeptember 5, 2026
• wpmu dev - your all-in-one wordpress platform broken link checker Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log CVE-2026-75528 7.2 HighSeptember 2, 2026
• wpmudev wpmu dev dashboard WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion CVE-2026-76581 Public exploit 9.8 CriticalAugust 28, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field CVE-2026-18324 7.2 HighAugust 28, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter CVE-2026-18328 7.2 HighAugust 25, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) CVE-2026-18323 7.2 HighAugust 25, 2026
• unknown smartcrawl seo checker, analyzer & optimizer SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration CVE-2026-16979 4.3 MediumAugust 19, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration CVE-2026-15748 Public exploit 9.8 CriticalAugust 18, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter CVE-2026-12998 5.3 MediumAugust 16, 2026
• wpmudev wpmu dev dashboard WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint CVE-2026-15459 8.1 HighAugust 6, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field CVE-2026-18325 7.2 HighAugust 6, 2026
• wpmudev branda – white label & branding, free login page customizer Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover CVE-2026-11551 Public exploit 9.8 CriticalJune 19, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook CVE-2026-6214 6.5 MediumMay 7, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter CVE-2026-6222 5.3 MediumMay 7, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' CVE-2026-5192 7.5 HighMay 5, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter CVE-2026-2729 5.3 MediumMay 5, 2026
• wpmudev hustle – email marketing, lead generation, optins, popups Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation CVE-2026-2263 5.3 MediumApril 7, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2026-2002 Public exploit 4.4 MediumFebruary 17, 2026
• wpmudev hustle – email marketing, lead generation, optins, popups Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import CVE-2026-0911 Public exploit 7.5 HighJanuary 24, 2026
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export CVE-2025-14782 5.3 MediumJanuary 9, 2026
• wpmudev branda – white label & branding, free login page customizer Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover CVE-2025-14998 Public exploit 9.8 CriticalJanuary 2, 2026
• wpmudev hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdn Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File CVE-2025-14437 7.5 HighDecember 18, 2025
• wpmudev appointments Appointments <= 2.2.1 - Unauthenticated PHP Object Injection CVE-2017-20206 9.8 CriticalOctober 18, 2025
• wpmudev smartcrawl seo checker, analyzer & optimizer SmartCrawl SEO checker, analyzer & optimizer <= 3.14.3 - Missing Authorization to Plugin Settings Update CVE-2025-11163 4.3 MediumSeptember 30, 2025
• wpmudev forminator forms – contact form, payment form & custom form builder Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter CVE-2025-7638 4.9 MediumJuly 18, 2025
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion CVE-2025-6464 7.5 HighJuly 2, 2025
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion CVE-2025-6463 EPSS 15.1% 8.8 HighJuly 2, 2025
• wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 more Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters CVE-2025-5341 6.4 MediumJune 5, 2025
• wpmu dev - your all-in-one wordpress platform broken link checker Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View CVE-2025-4047 4.3 MediumJune 3, 2025
• unknown hustle Hustle < 7.8.5 - Admin+ Stored XSS CVE-2024-8492 4.8 MediumMay 15, 2025
• wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 more Forminator <= 1.42.0 - Order Replay Vulnerability CVE-2025-3479 5.3 MediumApril 17, 2025
• wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 more Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' CVE-2025-3487 6.4 MediumApril 17, 2025
• wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 more Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-0469 6.4 MediumFebruary 27, 2025
• unknown forminator forms Forminator < 1.38.3 - Admin+ Stored XSS CVE-2024-7052 4.8 MediumFebruary 14, 2025
• wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 more Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter CVE-2025-0470 6.1 MediumJanuary 31, 2025
• wpmudev hustle, hustle – email marketing, lead generation, optins, popups +1 more Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission CVE-2024-10580 5.3 MediumNovember 27, 2024
• wpmudev hustle – email marketing, lead generation, optins, popups Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure CVE-2024-10579 4.3 MediumNovember 26, 2024
• wpmudev branda – white label & branding, free login page customizer Branda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting CVE-2024-9371 6.1 MediumNovember 21, 2024
• unknown defender security, wpmudev defender +1 more WordPress Defender plugin <= 4.7.1 - Broken Access Control vulnerability CVE-2024-37444 5.3 MediumNovember 1, 2024
• Show olderLoading…