WP
Vendor
wpmudev
103
CVEs
0
On KEV
8
New 30D
Products
FF9.8
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
wpmudev
36 CVEs0 on KEV5 new
HE8.6
Hustle – Email Marketing, Lead Generation, Optins, Popups
wpmudev
7 CVEs0 on KEV2 new
BL7.2
Broken Link Checker
wpmudev
8 CVEs0 on KEV1 new
FF8.8
Forminator Forms
Wpmudev
10 CVEs0 on KEV0 new
DS9.8
Defender Security
Wpmudev
7 CVEs0 on KEV0 new
BW9.8
Branda – White Label & Branding, Free Login Page Customizer
wpmudev
5 CVEs0 on KEV0 new
BR5.4
Branda
Wpmudev
4 CVEs0 on KEV0 new
DE9.8
Defender
Wpmudev
4 CVEs0 on KEV0 new
HU8.6
Hustle
Wpmudev
3 CVEs0 on KEV0 new
SM7.5
Smartcrawl
Wpmudev
3 CVEs0 on KEV0 new
SS5.3
SmartCrawl SEO checker, analyzer & optimizer
wpmudev
3 CVEs0 on KEV0 new
CS8.8
Custom Sidebars
Wpmudev
2 CVEs0 on KEV0 new
HP9.8
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
wpmudev
2 CVEs0 on KEV0 new
SI7.5
Smush Image Compression And Optimization
Wpmudev
2 CVEs0 on KEV0 new
WD9.8
WPMU DEV Dashboard
wpmudev
2 CVEs0 on KEV0 new
AP9.8
Appointments
wpmudev
1 CVEs0 on KEV0 new
BW5.3
Branda White Label Wordpress Custom Login Page Customizer
Wpmudev
1 CVEs0 on KEV0 new
DS4.3
Defender Security – Malware Scanner, Login Security & Firewall
wpmudev
1 CVEs0 on KEV0 new
HU8.8
Hummingbird
Wpmudev
1 CVEs0 on KEV0 new
SI4.3
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
wpmudev
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-5461 New | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 6.5 | Oct 30 | Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata |
| CVE-2026-118169 New | HE Hustle – Email Marketing, Lead Generation, Optins, Popups wpmudev | 4.9 | Oct 28 | Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter |
| CVE-2026-107710 New | HE Hustle – Email Marketing, Lead Generation, Optins, Popups wpmudev | 6.4 | Oct 28 | Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title |
| CVE-2026-103911 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 6.5 | Oct 16 | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block |
| CVE-2026-101335 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 6.5 | Oct 16 | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags |
| CVE-2026-96562 | BL Broken Link Checker wpmudev | 6.5 | Oct 16 | Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback |
| CVE-2026-92144 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 7.2 | Oct 1 | Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter |
| CVE-2026-85235 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 7.2 | Oct 1 | Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field |
| CVE-2026-92229 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 9.1 | Sep 19 | Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter |
| CVE-2026-83627 | HP Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN wpmudev | 9.8 | Sep 5 | Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log |
| CVE-2026-75528 | BL Broken Link Checker wpmudev | 7.2 | Sep 2 | Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log |
| CVE-2026-76581 | WD WPMU DEV Dashboard wpmudev | 9.8 | Aug 28 | WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion |
| CVE-2026-18324 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 7.2 | Aug 28 | Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field |
| CVE-2026-18328 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 7.2 | Aug 25 | Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter |
| CVE-2026-18323 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 7.2 | Aug 25 | Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) |
| CVE-2026-15748 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 9.8 | Aug 18 | Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration |
| CVE-2026-12998 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 5.3 | Aug 16 | Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter |
| CVE-2026-15459 | WD WPMU DEV Dashboard wpmudev | 8.1 | Aug 6 | WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint |
| CVE-2026-18325 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 7.2 | Aug 6 | Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field |
| CVE-2026-11551 | BW Branda – White Label & Branding, Free Login Page Customizer wpmudev | 9.8 | Jun 19 | Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2026-6214 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 6.5 | May 7 | Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook |
| CVE-2026-6222 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 5.3 | May 7 | Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter |
| CVE-2026-5192 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 7.5 | May 5 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' |
| CVE-2026-2729 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 5.3 | May 5 | Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter |
| CVE-2026-2263 | HE Hustle – Email Marketing, Lead Generation, Optins, Popups wpmudev | 5.3 | Apr 7 | Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation |
| CVE-2026-2002 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 4.4 | Feb 17 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting |
| CVE-2026-0911 | HE Hustle – Email Marketing, Lead Generation, Optins, Popups wpmudev | 7.5 | Jan 24 | Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import |
| CVE-2025-14782 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 5.3 | Jan 9 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export |
| CVE-2025-14998 | BW Branda – White Label & Branding, Free Login Page Customizer wpmudev | 9.8 | Jan 2 | Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-14437 | HP Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN wpmudev | 7.5 | Dec 18 | Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File |
| CVE-2017-20206 | AP Appointments wpmudev | 9.8 | Oct 18 | Appointments <= 2.2.1 - Unauthenticated PHP Object Injection |
| CVE-2025-11163 | SS SmartCrawl SEO checker, analyzer & optimizer wpmudev | 4.3 | Sep 30 | SmartCrawl SEO checker, analyzer & optimizer <= 3.14.3 - Missing Authorization to Plugin Settings Update |
| CVE-2025-7638 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 4.9 | Jul 18 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter |
| CVE-2025-6464 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 8.8 | Jul 2 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion |
| CVE-2025-6463 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 8.8 | Jul 2 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion |
| CVE-2025-5341 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 6.4 | Jun 5 | Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters |
| CVE-2025-4047 | BL Broken Link Checker wpmudev | 4.3 | Jun 3 | Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View |
| CVE-2024-8492 | HU Hustle Wpmudev | 4.8 | May 15 | Hustle < 7.8.5 - Admin+ Stored XSS |
| CVE-2025-3479 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 5.3 | Apr 17 | Forminator <= 1.42.0 - Order Replay Vulnerability |
| CVE-2025-3487 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 5.4 | Apr 17 | Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' |
| CVE-2025-0469 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 5.4 | Feb 27 | Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-7052 | FF Forminator Forms Wpmudev | 4.8 | Feb 14 | Forminator < 1.38.3 - Admin+ Stored XSS |
| CVE-2025-0470 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 6.1 | Jan 31 | Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter |
| CVE-2024-10580 | HE Hustle – Email Marketing, Lead Generation, Optins, Popups wpmudev | 5.3 | Nov 27 | Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission |
| CVE-2024-10579 | HE Hustle – Email Marketing, Lead Generation, Optins, Popups wpmudev | 4.3 | Nov 26 | Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure |
| CVE-2024-9371 | BW Branda – White Label & Branding, Free Login Page Customizer wpmudev | 6.1 | Nov 21 | Branda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting |
| CVE-2024-37444 | DE Defender Wpmudev | 9.8 | Nov 1 | WordPress Defender plugin <= 4.7.1 - Broken Access Control vulnerability |
| CVE-2024-9700 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 5.3 | Oct 31 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation |
| CVE-2024-10402 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 8.8 | Oct 26 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation |
| CVE-2024-9351 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 4.3 | Oct 17 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation |
| CVE-2024-9352 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 4.3 | Oct 17 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation |
| CVE-2024-8981 | BL Broken Link Checker wpmudev | 7.1 | Oct 1 | Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting |
| CVE-2024-43117 | HU Hummingbird Wpmudev | 8.8 | Aug 26 | WordPress Hummingbird plugin <= 3.9.1 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-7389 | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 7.5 | Aug 2 | Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure |
| CVE-2024-37239 | BR Branda Wpmudev | 4.8 | Jul 22 | WordPress Branda plugin <= 3.4.17 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-6554 | BW Branda – White Label & Branding, Free Login Page Customizer wpmudev | 5.3 | Jul 11 | Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure |
| CVE-2024-6556 | SS SmartCrawl SEO checker, analyzer & optimizer wpmudev | 5.3 | Jul 10 | SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path Disclosure |
| CVE-2024-5191 | BW Branda – White Label & Branding, Free Login Page Customizer wpmudev | 5.4 | Jun 21 | Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload |
| CVE-2023-3352 | SI Smush – Image Optimization, Compression, Lazy Load, WebP & CDN wpmudev | 4.3 | Jun 21 | Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion |
| CVE-2023-51542 | BR Branda Wpmudev | 5.3 | Jun 4 | WordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerability |