WPMU DEV

100 results · Feed

• Medium 4.3
  CVE-2023-3352

  Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion

  The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscribe…

  WPMU DEV Smush – Image Optimization, Compression, Lazy Load, WebP & CDN Web / CMS
  Jun 21, 2024
• Medium 5.3
  CVE-2023-51542

  WordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerability

  Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.

  WPMU DEV Branda
  Jun 4, 2024
• Medium 5.3
  CVE-2023-47189

  WordPress Defender Security plugin <= 4.2.0 - Masked Login Area View Bypass vulnerability

  Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.

  WPMU DEV Defender Security
  Jun 4, 2024
• Medium 5.3
  CVE-2024-25595

  WordPress Defender Security plugin <= 4.4.1 - IP Restriction Bypass vulnerability

  Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1.

  WPMU DEV Defender Security
  May 17, 2024
• Medium 5.0
  CVE-2022-44581

  WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability

  Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.

  WPMU DEV Defender Security
  May 17, 2024
• Medium 5.3
  CVE-2024-3287

  SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization

  The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to unauthorized ld+json description injection due to a missing capability check on the save_settings function in all versions up to, and including, 3.10.2. Th…

  WPMU DEV SmartCrawl SEO checker, analyzer & optimizer Web / CMS
  May 2, 2024
• Medium 5.3
  CVE-2024-28890

  Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerabi…

  WPMU DEV Forminator
  Apr 23, 2024
• High 7.2
  CVE-2024-31077 EPSS 30%

  Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authent…

  WPMU DEV Forminator
  Apr 23, 2024
• Medium 5.4
  CVE-2024-31857

  Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote …

  WPMU DEV Forminator
  Apr 23, 2024
• High 7.2
  CVE-2024-1794

  Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

  The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthen…

  WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  Apr 9, 2024
• Medium 6.4
  CVE-2024-3053

  Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode

  The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminator_form shortcode attribute in versions up to, and including, 1.29.2 due to insufficient input sanitizatio…

  WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  Apr 9, 2024
• Medium 5.9
  CVE-2024-25592

  WordPress Broken Link Checker plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link Checker: from n/a through 2.2.3.

  WPMU DEV Broken Link Checker
  Mar 15, 2024
• High 8.6
  CVE-2024-0368 Public exploit

  Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

  The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extr…

  WPMU DEV Hustle – Email Marketing, Lead Generation, Optins, Popups Web / CMS
  Mar 13, 2024
• Medium 5.3
  CVE-2023-51490

  WordPress Defender Security Plugin <= 4.1.0 is vulnerable to Sensitive Data Exposure

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.

  WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall
  Jan 8, 2024
• Medium 6.6
  CVE-2023-6133

  Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

  The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with admi…

  WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  Nov 15, 2023
• Critical 9.8
  CVE-2023-4596 Public exploit Scanner template EPSS 14%

  Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

  The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible…

  WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  Aug 30, 2023
• Medium 4.3
  CVE-2021-4425

  Defender Security <= 2.4.6 - Cross-Site Request Forgery Bypass

  The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenti…

  WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall Web / CMS
  Jul 12, 2023
• Medium 5.4
  CVE-2021-4417

  Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass

  The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4. This is due to missing or incorrect nonce validation on the listen_for_saving_export_s…

  WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  Jul 12, 2023
• High 7.1
  CVE-2021-36821

  WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.

  WPMU DEV Forminator
  Mar 16, 2023
• High 7.2
  CVE-2022-2438

  Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization

  The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to…

  WPMU DEV Broken Link Checker Web / CMS
  Sep 6, 2022