# cve.now: Wpmu DEV

The newest entries naming Wpmu DEV as an affected vendor (up to 200), of 35 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121763](https://cve.now/CVE-2026-121763.md): WordPress Hummingbird plugin \<= 3.21.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-120845](https://cve.now/CVE-2026-120845.md): WordPress Smush Image Compression and Optimization plugin \<= 4.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-115952](https://cve.now/CVE-2026-115952.md): WordPress Forminator plugin \<= 1.58.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-116859](https://cve.now/CVE-2026-116859.md): WordPress Forminator plugin \<= 1.58.3 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-116858](https://cve.now/CVE-2026-116858.md): WordPress Forminator plugin \<= 1.58.3 - Content Injection vulnerability (CVSS 4.3)
- [CVE-2026-110901](https://cve.now/CVE-2026-110901.md): WordPress SmartCrawl plugin \<= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4)
- [CVE-2026-102389](https://cve.now/CVE-2026-102389.md): WordPress Broken Link Checker plugin \<= 2.4.14.1 - Content Injection vulnerability (CVSS 6.5)
- [CVE-2026-108486](https://cve.now/CVE-2026-108486.md): WordPress Forminator plugin \<= 1.58.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-65459](https://cve.now/CVE-2026-65459.md): WordPress Forminator plugin \<= 1.57.3 - Arbitrary Content Deletion vulnerability (CVSS 7.5)
- [CVE-2026-96341](https://cve.now/CVE-2026-96341.md): WordPress Forminator plugin \<= 1.57.3 - Privilege Escalation vulnerability (CVSS 8.2)
- [CVE-2026-102388](https://cve.now/CVE-2026-102388.md): WordPress Forminator plugin \<= 1.57.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-96336](https://cve.now/CVE-2026-96336.md): WordPress Forminator plugin \<= 1.57.2 - Payment Bypass vulnerability (CVSS 7.5)
- [CVE-2026-106611](https://cve.now/CVE-2026-106611.md): WordPress Forminator plugin \<= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1)
- [CVE-2026-96335](https://cve.now/CVE-2026-96335.md): WordPress Forminator plugin \<= 1.57.2 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-103075](https://cve.now/CVE-2026-103075.md): WordPress Hustle plugin \<= 7.8.14.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-102376](https://cve.now/CVE-2026-102376.md): WordPress Branda plugin \<= 3.4.32 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-84772](https://cve.now/CVE-2026-84772.md): WordPress Broken Link Checker plugin \<= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.5)
- [CVE-2026-82220](https://cve.now/CVE-2026-82220.md): WordPress Forminator plugin \<= 1.57.1 - Other vulnerability Type vulnerability (CVSS 5.3)
- [CVE-2026-81285](https://cve.now/CVE-2026-81285.md): WordPress Smush Image Compression and Optimization plugin \<= 4.2.0 - Denial of Service Attack vulnerability (CVSS 7.5)
- [CVE-2026-66583](https://cve.now/CVE-2026-66583.md): WordPress Forminator plugin \<= 1.57.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-28143](https://cve.now/CVE-2026-28143.md): WordPress Forminator plugin \<= 1.56.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-28111](https://cve.now/CVE-2026-28111.md): WordPress Forminator plugin \<= 1.56.0 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2026-56071](https://cve.now/CVE-2026-56071.md): WordPress Forminator plugin \<= 1.53.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-25431](https://cve.now/CVE-2026-25431.md): WordPress Hustle plugin \<= 7.8.10.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-45625](https://cve.now/CVE-2024-45625.md): Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. (CVSS 6.1)
- [CVE-2023-51542](https://cve.now/CVE-2023-51542.md): WordPress Branda plugin \<= 3.4.14 - IP Restriction Bypass vulnerability (CVSS 5.3)
- [CVE-2023-47189](https://cve.now/CVE-2023-47189.md): WordPress Defender Security plugin \<= 4.2.0 - Masked Login Area View Bypass vulnerability (CVSS 5.3)
- [CVE-2024-25595](https://cve.now/CVE-2024-25595.md): WordPress Defender Security plugin \<= 4.4.1 - IP Restriction Bypass vulnerability (CVSS 5.3)
- [CVE-2022-44581](https://cve.now/CVE-2022-44581.md): WordPress Defender Security plugin \<= 3.3.2 - Broken Authentication vulnerability (CVSS 5.0)
- [CVE-2024-28890](https://cve.now/CVE-2024-28890.md): Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. (CVSS 5.3)
- [CVE-2024-31077](https://cve.now/CVE-2024-31077.md): Forminator prior to 1.29.3 contains a SQL injection vulnerability. (CVSS 7.2)
- [CVE-2024-31857](https://cve.now/CVE-2024-31857.md): Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. (CVSS 5.4)
- [CVE-2024-25592](https://cve.now/CVE-2024-25592.md): WordPress Broken Link Checker plugin \<= 2.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2023-51490](https://cve.now/CVE-2023-51490.md): WordPress Defender Security Plugin \<= 4.1.0 is vulnerable to Sensitive Data Exposure (CVSS 5.3)
- [CVE-2021-36821](https://cve.now/CVE-2021-36821.md): WordPress Forminator plugin \<= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpmu-dev
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.