Skip to content
OpenAdvisories

Vendor

WPMU DEV

100 known vulnerabilities.

Products

Forminator Forms – Contact Form, Payment Form & Custom Form Builder 37 Forminator 20 Broken Link Checker 8 Hustle – Email Marketing, Lead Generation, Optins, Popups 8 Branda – White Label & Branding, Free Login Page Customizer 5 SmartCrawl SEO checker, analyzer & optimizer 3 Defender Security 3 WPMU DEV Dashboard 2 Smush Image Compression and Optimization 2 Branda 2 Hustle 2 Defender Security – Malware Scanner, Login Security & Firewall 2 Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN 2 Smush – Image Optimization, Compression, Lazy Load, WebP & CDN 1 Appointments 1 SmartCrawl 1 Hummingbird 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-92229 Public exploit

    Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

    The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that …

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Critical 9.8
    CVE-2026-83627

    Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log

    The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debu…

    WPMU DEV Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Web / CMS
  • Critical 9.8
    CVE-2026-76581 Public exploit

    WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion

    The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` A…

    WPMU DEV WPMU DEV Dashboard Web / CMS
  • Critical 9.8
    CVE-2026-66583

    WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

    WPMU DEV Forminator
  • Critical 9.8
    CVE-2026-15748 Public exploit

    Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

    The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-exte…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Critical 9.8
    CVE-2026-11551 Public exploit

    Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover

    The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possib…

    WPMU DEV Branda – White Label & Branding, Free Login Page Customizer Web / CMS
  • Critical 9.8
    CVE-2025-14998 Public exploit Scanner template

    Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover

    The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possib…

    WPMU DEV Branda – White Label & Branding, Free Login Page Customizer Web / CMS
  • Critical 9.8
    CVE-2017-20206

    Appointments <= 2.2.1 - Unauthenticated PHP Object Injection

    The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the `wpmudev_appointments` cookie. This allows unauthenticated attackers to inject a PHP Object. At…

    WPMU DEV Appointments Web / CMS
  • Critical 9.8
    CVE-2023-4596 Public exploit Scanner template EPSS 14%

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS