Skip to content
OpenAdvisories

Vendor

WPMU DEV

100 known vulnerabilities.

Products

Forminator Forms – Contact Form, Payment Form & Custom Form Builder 37 Forminator 20 Broken Link Checker 8 Hustle – Email Marketing, Lead Generation, Optins, Popups 8 Branda – White Label & Branding, Free Login Page Customizer 5 SmartCrawl SEO checker, analyzer & optimizer 3 Defender Security 3 WPMU DEV Dashboard 2 Smush Image Compression and Optimization 2 Branda 2 Hustle 2 Defender Security – Malware Scanner, Login Security & Firewall 2 Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN 2 Smush – Image Optimization, Compression, Lazy Load, WebP & CDN 1 Appointments 1 SmartCrawl 1 Hummingbird 1
All Critical High Medium Low Exploited only Public exploit

33 results · Clear filters · Feed

  • High 7.5
    CVE-2026-97638

    Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a …

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.5
    CVE-2026-65459

    WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

    Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

    WPMU DEV Forminator
  • High 8.2
    CVE-2026-96341

    WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-102388

    WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-96336

    WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-106611

    WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-96335

    WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.

    WPMU DEV Forminator
  • High 7.2
    CVE-2026-92144

    Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitizati…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.2
    CVE-2026-85235

    Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and outp…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.1
    CVE-2026-102376

    WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.

    WPMU DEV Branda
  • High 7.2
    CVE-2026-75528

    Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log

    The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for una…

    WPMU DEV Broken Link Checker Web / CMS
  • High 7.5
    CVE-2026-81285

    WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability

    Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.

    WPMU DEV Smush Image Compression and Optimization
  • High 7.2
    CVE-2026-18324

    Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and ou…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.2
    CVE-2026-18328

    Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.2
    CVE-2026-18323

    Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input saniti…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.1
    CVE-2026-28143

    WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

    WPMU DEV Forminator
  • High 8.8
    CVE-2026-28111

    WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

    Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

    WPMU DEV Forminator
  • High 8.1
    CVE-2026-15459

    WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint

    The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH req…

    WPMU DEV WPMU DEV Dashboard Web / CMS
  • High 7.2
    CVE-2026-18325

    Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitiza…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.1
    CVE-2026-56071

    WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-5192

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter. This makes it possible for unauthenticated att…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.5
    CVE-2026-0911 Public exploit

    Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import

    The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_import_module() function in all versions up to, and including, 7.8.9.2. This makes i…

    WPMU DEV Hustle – Email Marketing, Lead Generation, Optins, Popups Web / CMS
  • High 7.5
    CVE-2025-14437 Scanner template

    Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File

    The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including …

    WPMU DEV Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN Web / CMS
  • High 7.5
    CVE-2025-6464

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function.…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 8.8
    CVE-2025-6463 EPSS 15%

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.5
    CVE-2024-10402

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenti…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.1
    CVE-2024-8981

    Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting

    The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. Thi…

    WPMU DEV Broken Link Checker Web / CMS
  • High 7.5
    CVE-2024-7389

    Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

    The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integra…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 7.2
    CVE-2024-31077 EPSS 30%

    Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authent…

    WPMU DEV Forminator
  • High 7.2
    CVE-2024-1794

    Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

    The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthen…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • High 8.6
    CVE-2024-0368 Public exploit

    Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

    The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extr…

    WPMU DEV Hustle – Email Marketing, Lead Generation, Optins, Popups Web / CMS
  • High 7.1
    CVE-2021-36821

    WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.

    WPMU DEV Forminator
  • High 7.2
    CVE-2022-2438

    Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization

    The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to…

    WPMU DEV Broken Link Checker Web / CMS