CVEs we hold for Wpmu
Records whose assigning authority named Wpmu as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-92229Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameterwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-84772WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerabilityWPMU DEV Broken Link Checker
CVE-2026-83627Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via…wpmudev Hummingbird Performance – Cache & Page Speed…
CVE-2026-82220WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerabilityWPMU DEV Forminator
CVE-2026-81285WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerabilityWPMU DEV Smush Image Compression and Optimization
CVE-2026-76581WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusionwpmudev WPMU DEV Dashboard
CVE-2026-75528Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Logwpmudev Broken Link Checker
CVE-2026-66583WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerabilityWPMU DEV Forminator
CVE-2026-6222Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-6214Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-57815WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Forminator
CVE-2026-57814WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Forminator
CVE-2026-56071WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV Forminator
CVE-2026-5192Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-39466WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Broken Link…
CVE-2026-32409WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Forminator
CVE-2026-28143WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV Forminator
CVE-2026-28111WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerabilityWPMU DEV Forminator
CVE-2026-2729Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-25431WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerabilityWPMU DEV Hustle
CVE-2026-24998WordPress Hustle plugin <= 7.8.9.2 - Sensitive Data Exposure vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Hustle
CVE-2026-2263Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated…wpmudev Hustle – Email Marketing, Lead Generation, Optins…
CVE-2026-2002Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-18328Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameterwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-18325Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Fieldwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-18324Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Fieldwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-18323Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-16051WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install ActionUnknown wpmudev-updates
CVE-2026-15748Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configurationwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-15459WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged…wpmudev WPMU DEV Dashboard
CVE-2026-12998Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2026-11551Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via…wpmudev Branda – White Label & Branding, Free Login Page…
CVE-2026-0911Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Importwpmudev Hustle – Email Marketing, Lead Generation, Optins…
CVE-2025-7638Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2025-6464Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2025-6463Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2025-62048WordPress SmartCrawl plugin <= 3.14.3 - Broken Access Control vulnerabilityWPMU DEV - Your All-in-One WordPress Platform SmartCrawl
CVE-2025-5341Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2025-4047Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard Viewwpmudev Broken Link Checker
CVE-2025-3487Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2025-3479Forminator <= 1.42.0 - Order Replay Vulnerabilitywpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2025-22288WordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Smush Image…
CVE-2025-14998Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via…wpmudev Branda – White Label & Branding, Free Login Page…
CVE-2025-14782Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2025-14437Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log Filewpmudev Hummingbird Performance – Cache & Page Speed…
CVE-2025-11163SmartCrawl SEO checker, analyzer & optimizer <= 3.14.3 - Missing Authorization to Plugin Settings Updatewpmudev SmartCrawl SEO checker, analyzer & optimizer
CVE-2025-0470Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameterwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2025-0469Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2024-9700Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2024-9371Branda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scriptingwpmudev Branda – White Label & Branding, Free Login Page…
CVE-2024-9352Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2024-9351Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2024-8981Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scriptingwpmudev Broken Link Checker
CVE-2024-7389Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposurewpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2024-6556SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path Disclosurewpmudev SmartCrawl SEO checker, analyzer & optimizer
CVE-2024-6554Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosurewpmudev Branda – White Label & Branding, Free Login Page…
CVE-2024-5191Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site…wpmudev Branda – White Label & Branding, Free Login Page…
CVE-2024-43118WordPress Hummingbird plugin <= 3.9.1 - Broken Access Control vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Hummingbird
CVE-2024-43117WordPress Hummingbird plugin <= 3.9.1 - Cross Site Request Forgery (CSRF) vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Hummingbird
CVE-2024-37444WordPress Defender plugin <= 4.7.1 - Broken Access Control vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Defender…
CVE-2024-37239WordPress Branda plugin <= 3.4.17 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Branda
CVE-2024-3287SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorizationwpmudev SmartCrawl SEO checker, analyzer & optimizer
CVE-2024-32792WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Hummingbird
CVE-2024-3053Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2024-29777WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Forminator
CVE-2024-25595WordPress Defender Security plugin <= 4.4.1 - IP Restriction Bypass vulnerabilityWPMU DEV Defender Security
CVE-2024-25592WordPress Broken Link Checker plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV Broken Link Checker
CVE-2024-1794Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Uploadwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2024-10580Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form…wpmudev Hustle – Email Marketing, Lead Generation, Optins…
CVE-2024-10579Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposurewpmudev Hustle – Email Marketing, Lead Generation, Optins…
CVE-2024-10402Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated…wpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2024-0368Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keyswpmudev Hustle – Email Marketing, Lead Generation, Optins…
CVE-2023-6133Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Uploadwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2023-51542WordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerabilityWPMU DEV Branda
CVE-2023-51490WordPress Defender Security Plugin <= 4.1.0 is vulnerable to Sensitive Data ExposureWPMU DEV Defender Security – Malware Scanner, Login…
CVE-2023-47189WordPress Defender Security plugin <= 4.2.0 - Masked Login Area View Bypass vulnerabilityWPMU DEV Defender Security
CVE-2023-4596Forminator <= 1.24.6 - Unauthenticated Arbitrary File Uploadwpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2023-3352Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletionwpmudev Smush – Image Optimization, Compression, Lazy Load…
CVE-2022-44581WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerabilityWPMU DEV Defender Security
CVE-2022-2438Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserializationwpmudev Broken Link Checker
CVE-2021-4425Defender Security <= 2.4.6 - Cross-Site Request Forgery Bypasswpmudev Defender Security – Malware Scanner, Login Security…
CVE-2021-4417Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypasswpmudev Forminator Forms – Contact Form, Payment Form &…
CVE-2021-36821WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerabilityWPMU DEV Forminator
88 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.