# cve.now: Wpmudev

The newest entries naming Wpmudev as an affected vendor (up to 200), of 65 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109386](https://cve.now/CVE-2026-109386.md): Hustle \<= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via… (CVSS 4.3)
- [CVE-2026-97638](https://cve.now/CVE-2026-97638.md): Forminator Forms \<= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via… (CVSS 7.5)
- [CVE-2026-5461](https://cve.now/CVE-2026-5461.md): Forminator Forms \<= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata (CVSS 6.5)
- [CVE-2026-118169](https://cve.now/CVE-2026-118169.md): Hustle \<= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta\_label' Parameter (CVSS 4.9)
- [CVE-2026-107710](https://cve.now/CVE-2026-107710.md): Hustle \<= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title (CVSS 6.4)
- [CVE-2026-103911](https://cve.now/CVE-2026-103911.md): Forminator Forms \<= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render\_block (CVSS 6.5)
- [CVE-2026-101335](https://cve.now/CVE-2026-101335.md): Forminator Forms \<= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer\_url' Parameter via Quiz Notification Merge Tags (CVSS 6.5)
- [CVE-2026-96562](https://cve.now/CVE-2026-96562.md): Broken Link Checker \<= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser\_callback (CVSS 6.5)
- [CVE-2026-92144](https://cve.now/CVE-2026-92144.md): Forminator Forms \<= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1\[post-custom\]' Parameter (CVSS 7.2)
- [CVE-2026-85235](https://cve.now/CVE-2026-85235.md): Forminator Forms \<= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field (CVSS 7.2)
- [CVE-2026-92229](https://cve.now/CVE-2026-92229.md): Forminator Forms \<= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current\_url' Parameter (CVSS 9.1)
- [CVE-2026-83627](https://cve.now/CVE-2026-83627.md): Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN \<= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log (CVSS 9.8)
- [CVE-2026-75528](https://cve.now/CVE-2026-75528.md): Broken Link Checker \<= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log (CVSS 7.2)
- [CVE-2026-76581](https://cve.now/CVE-2026-76581.md): WPMU DEV Dashboard \<= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion (CVSS 9.8)
- [CVE-2026-18324](https://cve.now/CVE-2026-18324.md): Forminator Forms \<= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field (CVSS 7.2)
- [CVE-2026-18328](https://cve.now/CVE-2026-18328.md): Forminator Forms \<= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error\_description' Parameter (CVSS 7.2)
- [CVE-2026-18323](https://cve.now/CVE-2026-18323.md): Forminator Forms \<= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) (CVSS 7.2)
- [CVE-2026-15748](https://cve.now/CVE-2026-15748.md): Forminator Forms \<= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration (CVSS 9.8)
- [CVE-2026-12998](https://cve.now/CVE-2026-12998.md): Forminator Forms \<= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter (CVSS 5.3)
- [CVE-2026-15459](https://cve.now/CVE-2026-15459.md): WPMU DEV Dashboard \<= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP\_AUTH HMAC on ?wpmudev-hub= Endpoint (CVSS 8.1)
- [CVE-2026-18325](https://cve.now/CVE-2026-18325.md): Forminator Forms \<= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field (CVSS 7.2)
- [CVE-2026-11551](https://cve.now/CVE-2026-11551.md): Branda – White Label & Branding, Free Login Page Customizer \<= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8)
- [CVE-2026-6214](https://cve.now/CVE-2026-6214.md): Forminator Forms \<= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator\_export\_entries Action on wp\_loaded Hook (CVSS 6.5)
- [CVE-2026-6222](https://cve.now/CVE-2026-6222.md): Forminator Forms \<= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator\_action' Parameter (CVSS 5.3)
- [CVE-2026-5192](https://cve.now/CVE-2026-5192.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1\[file\]\[file\_path\]' (CVSS 7.5)
- [CVE-2026-2729](https://cve.now/CVE-2026-2729.md): Forminator – Contact Form, Payment Form & Custom Form Builder \<= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter (CVSS 5.3)
- [CVE-2026-2263](https://cve.now/CVE-2026-2263.md): Hustle – Email Marketing, Lead Generation, Optins, Popups \<= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation (CVSS 5.3)
- [CVE-2026-2002](https://cve.now/CVE-2026-2002.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2026-0911](https://cve.now/CVE-2026-0911.md): Hustle \<= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import (CVSS 7.5)
- [CVE-2025-14782](https://cve.now/CVE-2025-14782.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export (CVSS 5.3)
- [CVE-2025-14998](https://cve.now/CVE-2025-14998.md): Branda – White Label & Branding, Free Login Page Customizer \<= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8)
- [CVE-2025-14437](https://cve.now/CVE-2025-14437.md): Hummingbird \<= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File (CVSS 7.5)
- [CVE-2017-20206](https://cve.now/CVE-2017-20206.md): Appointments \<= 2.2.1 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2025-11163](https://cve.now/CVE-2025-11163.md): SmartCrawl SEO checker, analyzer & optimizer \<= 3.14.3 - Missing Authorization to Plugin Settings Update (CVSS 4.3)
- [CVE-2025-7638](https://cve.now/CVE-2025-7638.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.45.0 - Authenticated (Administrator+) SQL Injection via \`order\_by\` Parameter (CVSS 4.9)
- [CVE-2025-6464](https://cve.now/CVE-2025-6464.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion (CVSS 7.5)
- [CVE-2025-6463](https://cve.now/CVE-2025-6463.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion (CVSS 8.8)
- [CVE-2025-5341](https://cve.now/CVE-2025-5341.md): Forminator \<= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters (CVSS 6.4)
- [CVE-2025-4047](https://cve.now/CVE-2025-4047.md): Broken Link Checker \<= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View (CVSS 4.3)
- [CVE-2025-3479](https://cve.now/CVE-2025-3479.md): Forminator \<= 1.42.0 - Order Replay Vulnerability (CVSS 5.3)
- [CVE-2025-3487](https://cve.now/CVE-2025-3487.md): Forminator \<= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' (CVSS 6.4)
- [CVE-2025-0469](https://cve.now/CVE-2025-0469.md): Forminator \<= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-0470](https://cve.now/CVE-2025-0470.md): Forminator \<= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter (CVSS 6.1)
- [CVE-2024-10580](https://cve.now/CVE-2024-10580.md): Hustle – Email Marketing, Lead Generation, Optins, Popups \<= 7.8.5 - Missing Authorization to Unauthorized Form Submission (CVSS 5.3)
- [CVE-2024-10579](https://cve.now/CVE-2024-10579.md): Hustle – Email Marketing, Lead Generation, Optins, Popups \<= 7.8.5 - Missing Authorization to Unpublished Form Exposure (CVSS 4.3)
- [CVE-2024-9371](https://cve.now/CVE-2024-9371.md): Branda – White Label & Branding, Custom Login Page Customizer \<= 3.4.19 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-9700](https://cve.now/CVE-2024-9700.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation (CVSS 5.3)
- [CVE-2024-10402](https://cve.now/CVE-2024-10402.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation (CVSS 7.5)
- [CVE-2024-9351](https://cve.now/CVE-2024-9351.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation (CVSS 4.3)
- [CVE-2024-9352](https://cve.now/CVE-2024-9352.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation (CVSS 4.3)
- [CVE-2024-8981](https://cve.now/CVE-2024-8981.md): Broken Link Checker \<= 2.4.0 - Reflected Cross-Site Scripting (CVSS 7.1)
- [CVE-2024-7389](https://cve.now/CVE-2024-7389.md): Forminator \<= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure (CVSS 7.5)
- [CVE-2024-6554](https://cve.now/CVE-2024-6554.md): Branda – White Label WordPress, Custom Login Page Customizer \<= 3.4.18 - Unauthenticated Full Path Disclosure (CVSS 5.3)
- [CVE-2024-6556](https://cve.now/CVE-2024-6556.md): SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer \<= 3.10.8 - Unauthenticated Full Path Disclosure (CVSS 5.3)
- [CVE-2024-5191](https://cve.now/CVE-2024-5191.md): Branda – White Label WordPress, Custom Login Page Customizer \<= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 6.4)
- [CVE-2023-3352](https://cve.now/CVE-2023-3352.md): Smush – Lazy Load Images, Optimize & Compress Images \<= 3.16.4 - Missing Authorization to Resmush List Deletion (CVSS 4.3)
- [CVE-2024-3287](https://cve.now/CVE-2024-3287.md): SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer \<= 3.10.2 - Missing Authorization (CVSS 5.3)
- [CVE-2024-1794](https://cve.now/CVE-2024-1794.md): Forminator \<= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload (CVSS 7.2)
- [CVE-2024-3053](https://cve.now/CVE-2024-3053.md): Forminator – Contact Form, Payment Form & Custom Form Builder \<= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator\_form Shortcode (CVSS 6.4)
- [CVE-2024-0368](https://cve.now/CVE-2024-0368.md): Hustle \<= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys (CVSS 8.6)
- [CVE-2023-6133](https://cve.now/CVE-2023-6133.md): Forminator \<= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 6.6)
- [CVE-2023-4596](https://cve.now/CVE-2023-4596.md): Forminator \<= 1.24.6 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
- [CVE-2021-4425](https://cve.now/CVE-2021-4425.md): Defender Security \<= 2.4.6 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2021-4417](https://cve.now/CVE-2021-4417.md): Forminator – Contact Form, Payment Form & Custom Form Builder \<= 1.13.4 - Cross-Site Request Forgery Bypass (CVSS 5.4)
- [CVE-2022-2438](https://cve.now/CVE-2022-2438.md): Broken Link Checker \<= 1.11.16 - Authenticated (Admin+) PHAR Deserialization (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpmudev
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.