Skip to content
OpenAdvisories

Vendor

wpmudev

65 known vulnerabilities.

Products

Forminator Forms – Contact Form, Payment Form & Custom Form Builder 37 Hustle – Email Marketing, Lead Generation, Optins, Popups 8 Branda – White Label & Branding, Free Login Page Customizer 5 Broken Link Checker 5 SmartCrawl SEO checker, analyzer & optimizer 3 WPMU DEV Dashboard 2 Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN 2 Smush – Image Optimization, Compression, Lazy Load, WebP & CDN 1 Appointments 1 Defender Security – Malware Scanner, Login Security & Firewall 1
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-92229 Public exploit

    Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

    The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that …

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Critical 9.8
    CVE-2026-76581 Public exploit

    WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion

    The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` A…

    wpmudev WPMU DEV Dashboard Web / CMS
  • Critical 9.8
    CVE-2026-15748 Public exploit

    Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

    The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-exte…

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Critical 9.8
    CVE-2026-11551 Public exploit

    Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover

    The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possib…

    wpmudev Branda – White Label & Branding, Free Login Page Customizer Web / CMS
  • Medium 4.4
    CVE-2026-2002 Public exploit

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and outpu…

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.5
    CVE-2026-0911 Public exploit

    Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import

    The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_import_module() function in all versions up to, and including, 7.8.9.2. This makes i…

    wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups Web / CMS
  • Critical 9.8
    CVE-2025-14998 Public exploit

    Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover

    The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possib…

    wpmudev Branda – White Label & Branding, Free Login Page Customizer Web / CMS
  • High 8.6
    CVE-2024-0368 Public exploit

    Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

    The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extr…

    wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups Web / CMS
  • Critical 9.8
    CVE-2023-4596 Public exploit EPSS 14%

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible…

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS