WPMU DEV - Your All-in-One WordPress Platform
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Forminator | 4 | – | Jul 13, 2026 |
| Hummingbird | 3 | – | Nov 1, 2024 |
| Defender Security | 1 | – | Nov 1, 2024 |
| Hustle | 1 | – | Feb 3, 2026 |
| SmartCrawl | 1 | – | Oct 22, 2025 |
| Branda | 1 | – | Jul 22, 2024 |
| Smush Image Compression and Optimization | 1 | – | Nov 6, 2025 |
| Broken Link Checker | 1 | – | Apr 8, 2026 |
Exploited and recent CVEs
- CVE-2026-57815 WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability 0.5%
- CVE-2026-57814 WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability 0.3%
- CVE-2026-39466 WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerability 0.3%
- CVE-2026-32409 WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability 0.2%
- CVE-2026-24998 WordPress Hustle plugin <= 7.8.9.2 - Sensitive Data Exposure vulnerability 0.2%
- CVE-2025-22288 WordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerability 0.3%
- CVE-2025-62048 WordPress SmartCrawl plugin <= 3.14.3 - Broken Access Control vulnerability 0.2%
- CVE-2024-37444 WordPress Defender plugin <= 4.7.1 - Broken Access Control vulnerability 0.5%
- CVE-2024-43118 WordPress Hummingbird plugin <= 3.9.1 - Broken Access Control vulnerability 0.6%
- CVE-2024-43117 WordPress Hummingbird plugin <= 3.9.1 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
- CVE-2024-37239 WordPress Branda plugin <= 3.4.17 - Cross Site Scripting (XSS) vulnerability 0.3%
- CVE-2024-32792 WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerability 0.3%
- CVE-2024-29777 WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability 0.4%