Skip to content
OpenAdvisories

Vendor

WPMU DEV

35 known vulnerabilities.

WPMU DEV at a glance

Last 12 months
24
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 1 vulnerability June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 5 vulnerabilities, 1 critical September 2026: 2 vulnerabilities Sep October 2026: 10 vulnerabilities November 2026: 5 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202650
Oct 2026100
Sep 202620
Aug 202651
Jul 202600
Jun 202610
May 202610
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Forminator 20 Broken Link Checker 3 Defender Security 3 Smush Image Compression and Optimization 2 Branda 2 Hustle 2 Defender Security – Malware Scanner, Login Security & Firewall 1 SmartCrawl 1 Hummingbird 1
All Critical High Medium Low Exploited only Public exploit

35 results · Feed

  • Medium 6.5
    CVE-2026-121763

    WordPress Hummingbird plugin <= 3.21.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2.

    WPMU DEV Hummingbird
  • Medium 6.5
    CVE-2026-120845

    WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through …

    WPMU DEV Smush Image Compression and Optimization
  • Medium 6.5
    CVE-2026-115952

    WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.

    WPMU DEV Forminator
  • Medium 5.3
    CVE-2026-116859

    WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.

    WPMU DEV Forminator
  • Medium 4.3
    CVE-2026-116858

    WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.

    WPMU DEV Forminator
  • Medium 5.4
    CVE-2026-110901

    WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.

    WPMU DEV SmartCrawl
  • Medium 6.5
    CVE-2026-102389

    WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.

    WPMU DEV Broken Link Checker
  • Medium 5.3
    CVE-2026-108486

    WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-65459

    WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

    Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

    WPMU DEV Forminator
  • High 8.2
    CVE-2026-96341

    WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-102388

    WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-96336

    WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-106611

    WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-96335

    WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.

    WPMU DEV Forminator
  • Medium 4.3
    CVE-2026-103075

    WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.

    WPMU DEV Hustle
  • High 7.1
    CVE-2026-102376

    WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.

    WPMU DEV Branda
  • Medium 5.5
    CVE-2026-84772

    WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability

    Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

    WPMU DEV Broken Link Checker
  • Medium 5.3
    CVE-2026-82220

    WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability

    Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-81285

    WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability

    Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.

    WPMU DEV Smush Image Compression and Optimization
  • Critical 9.8
    CVE-2026-66583

    WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-28143

    WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

    WPMU DEV Forminator
  • High 8.8
    CVE-2026-28111

    WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

    Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-56071

    WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

    WPMU DEV Forminator
  • Medium 5.3
    CVE-2026-25431

    WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hustle: through 7.8.10.1.

    WPMU DEV Hustle
  • Medium 6.1
    CVE-2024-45625

    Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, a…

    WPMU DEV Forminator
  • Medium 5.3
    CVE-2023-51542

    WordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.

    WPMU DEV Branda
  • Medium 5.3
    CVE-2023-47189

    WordPress Defender Security plugin <= 4.2.0 - Masked Login Area View Bypass vulnerability

    Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.

    WPMU DEV Defender Security
  • Medium 5.3
    CVE-2024-25595

    WordPress Defender Security plugin <= 4.4.1 - IP Restriction Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1.

    WPMU DEV Defender Security
  • Medium 5.0
    CVE-2022-44581

    WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability

    Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.

    WPMU DEV Defender Security
  • Medium 5.3
    CVE-2024-28890

    Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerabi…

    WPMU DEV Forminator
  • High 7.2
    CVE-2024-31077 EPSS 30%

    Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authent…

    WPMU DEV Forminator
  • Medium 5.4
    CVE-2024-31857

    Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote …

    WPMU DEV Forminator
  • Medium 5.9
    CVE-2024-25592

    WordPress Broken Link Checker plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link Checker: from n/a through 2.2.3.

    WPMU DEV Broken Link Checker
  • Medium 5.3
    CVE-2023-51490

    WordPress Defender Security Plugin <= 4.1.0 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.

    WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall
  • High 7.1
    CVE-2021-36821

    WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.

    WPMU DEV Forminator