Wpmudev vulnerabilities
We track 30 vulnerabilities in Wpmudev products across 10 products. 30 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Wpmudev vulnerabilities
- 7.5 High severity
Forminator Forms – Contact Form, Payment Form…: Authorization Bypass Through User-Controlled Key
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a u
- 7.2 High severity
Forminator Forms – Contact Form, Payment Form…: Improper Neutralization of Input During Web Page Generation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitizatio
- 7.2 High severity
Forminator Forms – Contact Form, Payment Form…: Improper Neutralization of Input During Web Page Generation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and outpu
- 9.1 Critical severity
Forminator Forms – Contact Form, Payment Form…: Improper Control of Generation of Code
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that d
- 9.8 Critical severity
Hummingbird Performance – Cache & Page Speed…: Improper Control of Generation of Code
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug
- 7.2 High severity
Broken Link Checker: Improper Neutralization of Input During Web Page Generation
The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unau
- 9.8 Critical severity
WPMU DEV Dashboard: Improper Verification of Cryptographic Signature
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJ
- 7.2 High severity
Forminator Forms – Contact Form, Payment Form…: Improper Neutralization of Input During Web Page Generation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and out
- 7.2 High severity
Forminator Forms – Contact Form, Payment Form…: Improper Neutralization of Input During Web Page Generation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input
- 7.2 High severity
Forminator Forms – Contact Form, Payment Form…: Improper Neutralization of Input During Web Page Generation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitiz
- 9.8 Critical severity
Forminator Forms – Contact Form, Payment Form…: Unrestricted Upload of File with Dangerous Type
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-exten
- 8.1 High severity
WPMU DEV Dashboard: Improper Authentication
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH requ
- 7.2 High severity
Forminator Forms – Contact Form, Payment Form…: Improper Neutralization of Input During Web Page Generation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitizat
- 9.8 Critical severity
Branda – White Label & Branding, Free Login…: Weak Password Recovery Mechanism for Forgotten Password
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possibl
- 7.5 High severity
Forminator Forms – Contact Form, Payment Form…: Improper Limitation of a Pathname to a Restricted Directory
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter. This makes it possible for unauthenticated atta
- 7.5 High severity
Hustle – Email Marketing, Lead Generation…: Unrestricted Upload of File with Dangerous Type
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_import_module() function in all versions up to, and including, 7.8.9.2. This makes it
- 9.8 Critical severity
Branda – White Label & Branding, Free Login…: Authorization Bypass Through User-Controlled Key
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possibl
- 7.5 High severity
Hummingbird Performance – Cache & Page Speed…: Insertion of Sensitive Information into Log File
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including C
- 8.8 High severity
Forminator Forms – Contact Form, Payment Form…: Deserialization of Untrusted Data
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function.
- 8.8 High severity
Forminator Forms – Contact Form, Payment Form…: External Control of File Name or Path
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.4
- 9.8 Critical severity
Defender Security: Missing Authorization
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects Defender Security: from n/a through <= 4.7.1.
- 8.8 High severity
Forminator Forms – Contact Form, Payment Form…: Missing Authorization
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authentic
- 7.1 High severity
Broken Link Checker: Improper Neutralization of Script-Related HTML Tags in a Web Page
The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. This
- 7.5 High severity
Forminator Forms – Contact Form, Payment Form…: Insufficiently Protected Credentials
The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integrat
- 9.8 Critical severity
Defender Security: Improper Authentication
Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.
- 9.8 Critical severity
Defender Security: Insecure Storage of Sensitive Information
Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.
- 8.6 High severity
Hustle – Email Marketing, Lead Generation…: Insufficiently Protected Credentials
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extra
- 7.5 High severity
Defender Security – Malware Scanner, Login…: Insertion of Sensitive Information into Log File
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
- 9.8 Critical severity
Forminator Forms – Contact Form, Payment Form…: Unrestricted Upload of File with Dangerous Type
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible
- 7.2 High severity
Broken Link Checker: Deserialization of Untrusted Data
The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to