IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key

wpmudev vulnerabilities (CVE)

CVE records published for wpmudev, newest first. Follow to get an email when a new one appears.

Forminator Forms – Contact Form, Payment Form & Custom Form Builder 37Hustle – Email Marketing, Lead Generation, Optins, Popups 8forminator_forms 7broken_link_checker 6Branda – White Label & Branding, Free Login Page Customizer 5defender_security 4SmartCrawl SEO checker, analyzer & optimizer 3hustle 3WPMU DEV Dashboard 2Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN 2smartcrawl 2branda_white_label_wordpress_custom_login_page_customizer 1Smush – Image Optimization, Compression, Lazy Load, WebP & CDN 1Defender Security – Malware Scanner, Login Security & Firewall 1Appointments 1branda 1
73 results
4.3Medium
CVE-2026-109386

Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action

wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.14.3. This is due to the plugin not properly verifying that a user is authorized to perform an a…

7.5High
CVE-2026-97638

Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a …

6.5Medium
CVE-2026-103911

Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block

wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that …

6.5Medium
CVE-2026-101335

Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags

wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_sho…

9.8Critical
CVE-2026-83627

Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log

wpmudev Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debu…

1.4%EPSS
5.3Medium
CVE-2026-12998

Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter

wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user control…

9.8Critical
CVE-2026-11551

Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover

wpmudev Branda – White Label & Branding, Free Login Page Customizer

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possib…

6.5Medium
CVE-2026-6214

Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook

wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_schedule() function in library/class-export.php failing to perform a capability check before s…

5.3Medium
CVE-2026-6222

Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter

wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()` method in `Forminator_Admin_Module_Edit_Page` (admin/abstracts/class-admin-module-edit-page.php) dis…

7.5High
CVE-2026-5192

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'

wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter. This makes it possible for unauthenticated att…