wpmudev vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20234
3. 202417
4. 202512
5. 202631

Newest CVEs

• CVE-2026-109386

  Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action

  wpmudev · Hustle – Email Marketing, Lead Generation, Optins, Popups

  Medium4.3
• CVE-2026-97638

  Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

  wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  High7.5
• CVE-2026-5461

  Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

  wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  Medium6.5
• CVE-2026-118169

  Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter

  wpmudev · Hustle – Email Marketing, Lead Generation, Optins, Popups

  Medium4.9
• CVE-2026-107710

  Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

  wpmudev · Hustle – Email Marketing, Lead Generation, Optins, Popups

  Medium6.4
• CVE-2026-103911

  Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block

  wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  Medium6.5
• CVE-2026-101335

  Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags

  wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  Medium6.5
• CVE-2026-96562

  Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback

  wpmudev · Broken Link Checker

  Medium6.5
• CVE-2026-92144

  Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

  wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  High7.2
• CVE-2026-85235

  Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

  wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder

  High7.2