Login Request a demo
WP
Vendor
Wpmudev
16 products with CVEs on record
55
CVEs
0
On KEV
7
New 30D
Products
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
9.8
15 CVEs0 on KEV4 new
HE
Hustle – Email Marketing, Lead Generation, Optins, Popups
wpmudev
6.4
3 CVEs0 on KEV2 new
BL
Broken Link Checker
wpmudev
7.2
4 CVEs0 on KEV1 new
FF
Forminator Forms
Wpmudev
8.8
10 CVEs0 on KEV0 new
DE
Defender
Wpmudev
9.8
4 CVEs0 on KEV0 new
BR
Branda
Wpmudev
5.4
3 CVEs0 on KEV0 new
DS
Defender Security
Wpmudev
7.5
3 CVEs0 on KEV0 new
CS
Custom Sidebars
Wpmudev
8.8
2 CVEs0 on KEV0 new
HU
Hustle
Wpmudev
8.6
2 CVEs0 on KEV0 new
SI
Smush Image Compression And Optimization
Wpmudev
7.5
2 CVEs0 on KEV0 new
WD
WPMU DEV Dashboard
wpmudev
9.8
2 CVEs0 on KEV0 new
AP
Appointments
Wpmudev
9.8
1 CVEs0 on KEV0 new
BW
Branda – White Label & Branding, Free Login Page Customizer
wpmudev
9.8
1 CVEs0 on KEV0 new
HU
Hummingbird
Wpmudev
8.8
1 CVEs0 on KEV0 new
HP
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
wpmudev
9.8
1 CVEs0 on KEV0 new
SM
Smartcrawl
Wpmudev
7.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-118169
New
HE
Hustle – Email Marketing, Lead Generation, Optins, Popups
wpmudev
4.9–Oct 28Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
CVE-2026-107710
New
HE
Hustle – Email Marketing, Lead Generation, Optins, Popups
wpmudev
6.4–Oct 28Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
CVE-2026-103911
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
6.5
0%
Oct 16Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
CVE-2026-101335
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
6.5
0%
Oct 16Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
CVE-2026-96562
BL
Broken Link Checker
wpmudev
6.5
0%
Oct 16Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback
CVE-2026-92144
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
7.2
0%
Oct 1Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
CVE-2026-85235
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
7.2
0%
Oct 1Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
CVE-2026-92229
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
9.1
1%
Sep 19Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
CVE-2026-83627
HP
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
wpmudev
9.8
1%
Sep 5Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
CVE-2026-75528
BL
Broken Link Checker
wpmudev
7.2
1%
Sep 2Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
CVE-2026-76581
WD
WPMU DEV Dashboard
wpmudev
9.8
0%
Aug 28WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion
CVE-2026-18324
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
7.2
1%
Aug 28Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
CVE-2026-18328
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
7.2
0%
Aug 25Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
CVE-2026-18323
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
7.2
1%
Aug 25Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
CVE-2026-15748
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
9.8
4%
Aug 18Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
CVE-2026-12998
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
5.3
1%
Aug 16Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter
CVE-2026-15459
WD
WPMU DEV Dashboard
wpmudev
8.1
1%
Aug 6WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint
CVE-2026-18325
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
7.2
0%
Aug 6Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
CVE-2026-11551
BW
Branda – White Label & Branding, Free Login Page Customizer
wpmudev
9.8
1%
Jun 19Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover
CVE-2026-6214
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
6.5
0%
May 7Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook
CVE-2026-6222
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
5.3
0%
May 7Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter
CVE-2026-5192
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
7.5
1%
May 5Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'
CVE-2026-2729
FF
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
5.3
0%
May 5Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter
CVE-2026-2263
HE
Hustle – Email Marketing, Lead Generation, Optins, Popups
wpmudev
5.3
0%
Apr 7Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation
CVE-2017-20206
AP
Appointments
Wpmudev
9.8
1%
Oct 18The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the…
CVE-2025-5341
FF
Forminator Forms
Wpmudev
6.4
0%
Jun 5The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters…
CVE-2024-8492
HU
Hustle
Wpmudev
4.8
0%
May 15The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site…
CVE-2025-3487
FF
Forminator Forms
Wpmudev
5.4
0%
Apr 17The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions…
CVE-2025-3479
FF
Forminator Forms
Wpmudev
5.3
0%
Apr 17The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the…
CVE-2025-0469
FF
Forminator Forms
Wpmudev
5.4
0%
Feb 27The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all…
CVE-2024-7052
FF
Forminator Forms
Wpmudev
4.8
0%
Feb 14The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored…
CVE-2025-0470
FF
Forminator Forms
Wpmudev
6.1
0%
Jan 31The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all…
CVE-2024-37444
DE
Defender
Wpmudev
9.8
1%
Nov 1Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects Defender Security: from n/a through <=…
CVE-2024-9700
FF
Forminator Forms
Wpmudev
5.3
0%
Oct 31The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…
CVE-2024-10402
FF
Forminator Forms
Wpmudev
8.8
1%
Oct 26The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function…
CVE-2024-9352
FF
Forminator Forms
Wpmudev
4.3
0%
Oct 17The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,…
CVE-2024-9351
FF
Forminator Forms
Wpmudev
4.3
0%
Oct 17The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,…
CVE-2024-43117
HU
Hummingbird
Wpmudev
8.8
0%
Aug 26Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a…
CVE-2024-37239
BR
Branda
Wpmudev
4.8
0%
Jul 22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Branda…
CVE-2024-6554
BR
Branda
Wpmudev
5.3
0%
Jul 11The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.18
CVE-2024-5191
BR
Branda
Wpmudev
5.4
0%
Jun 21The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mime_types’ parameter in all versions…
CVE-2023-47189
DE
Defender
Wpmudev
9.8
0%
Jun 4Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a…
CVE-2024-25595
DE
Defender
Wpmudev
5.3
0%
May 17Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1
CVE-2022-44581
DE
Defender
Wpmudev
9.8
1%
May 17Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender…
CVE-2024-25592
BL
Broken Link Checker
Wpmudev
4.8
0%
Mar 15Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link…
CVE-2024-0368
HU
Hustle
Wpmudev
8.6
1%
Mar 13The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via…
CVE-2023-51490
DS
Defender Security
Wpmudev
7.5
0%
Jan 8Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender…
CVE-2023-5949
SM
Smartcrawl
Wpmudev
7.5
1%
Dec 18The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content
CVE-2023-5089
DS
Defender Security
Wpmudev
5.3
2%
Oct 16The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to…
CVE-2021-4425
DS
Defender Security
Wpmudev
4.3
1%
Jul 12The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6
CVE-2015-10098
BL
Broken Link Checker
Wpmudev
6.1
1%
Apr 8A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress
CVE-2022-1009
SI
Smush Image Compression And Optimization
Wpmudev
6.1
1%
May 30The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset…
CVE-2017-18511
CS
Custom Sidebars
Wpmudev
8.8
1%
Aug 14The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF
CVE-2017-18510
CS
Custom Sidebars
Wpmudev
8.8
1%
Aug 14The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions
CVE-2017-15079
SI
Smush Image Compression And Optimization
Wpmudev
7.5
3%
Oct 6The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal