Log in Start free

wpmudev

Products

ProductCVEsExploitedLatest
Forminator Forms – Contact Form, Payment Form & Custom Form Builder37–Oct 30, 2026
Hustle – Email Marketing, Lead Generation, Optins, Popups8–Oct 31, 2026
Branda – White Label & Branding, Free Login Page Customizer5–Jun 19, 2026
Broken Link Checker5–Oct 16, 2026
SmartCrawl SEO checker, analyzer & optimizer3–Sep 30, 2025
WPMU DEV Dashboard2–Aug 28, 2026
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN2–Sep 5, 2026
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN1–Jun 21, 2024
Defender Security – Malware Scanner, Login Security & Firewall1–Jul 12, 2023

Exploited and recent CVEs

  • CVE-2026-109386 Medium 4.3 Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action 0.4%
  • CVE-2026-97638 High 7.5 Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter 0.6%
  • CVE-2026-5461 Medium 6.5 Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata 0.3%
  • CVE-2026-118169 Medium 4.9 Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter 0.2%
  • CVE-2026-107710 Medium 6.4 Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title 0.2%
  • CVE-2026-103911 Medium 6.5 Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block 0.3%
  • CVE-2026-101335 Medium 6.5 Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags 0.3%
  • CVE-2026-96562 Medium 6.5 Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback 0.3%
  • CVE-2026-92144 High 7.2 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter 0.4%
  • CVE-2026-85235 High 7.2 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field 0.3%
  • CVE-2026-92229 Critical 9.1 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter 0.7%
  • CVE-2026-83627 Critical 9.8 Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log 1.4%
  • CVE-2026-75528 High 7.2 Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log 0.5%
  • CVE-2026-76581 Critical 9.8 WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion 0.4%
  • CVE-2026-18324 High 7.2 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field 0.5%
  • CVE-2026-18328 High 7.2 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter 0.4%
  • CVE-2026-18323 High 7.2 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) 0.5%
  • CVE-2026-15748 Critical 9.8 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration 4.1%
  • CVE-2026-12998 Medium 5.3 Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter 0.5%
  • CVE-2026-15459 High 8.1 WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint 0.9%
  • CVE-2026-18325 High 7.2 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field 0.5%
  • CVE-2026-11551 Critical 9.8 Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover 0.6%
  • CVE-2026-6214 Medium 6.5 Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook 0.4%
  • CVE-2026-6222 Medium 5.3 Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter 0.4%
  • CVE-2026-5192 High 7.5 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' 0.8%
  • CVE-2026-2729 Medium 5.3 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter 0.4%
  • CVE-2026-2263 Medium 5.3 Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation 0.4%
  • CVE-2026-2002 Medium 4.4 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting 0.2%
  • CVE-2026-0911 High 7.5 Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import 0.6%
  • CVE-2025-14782 Medium 5.3 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export 0.3%