WPMU DEV vulnerabilities

Products

• Forminator 20
• Broken Link Checker 3
• Defender Security 3
• Branda 2
• Hustle 2
• Smush Image Compression and Optimization 2
• Defender Security – Malware Scanner, Login Security & Firewall 1
• Hummingbird 1
• SmartCrawl 1

Latest WPMU DEV CVEs

Newest publication first · page 1 of 2

1. CVE-2026-121763 WordPress Hummingbird plugin <= 3.21.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-09

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2.

2. CVE-2026-120845 WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-06

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5.

3. CVE-2026-115952 WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-06

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.

4. CVE-2026-116859 WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability

   Published 2026-11-03

   Medium·CVSS 5.3 EPSS 0.23%

   Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.

5. CVE-2026-116858 WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

   Published 2026-11-03

   Medium·CVSS 4.3 EPSS 0.17%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.

6. CVE-2026-110901 WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-10-16

   Medium·CVSS 5.4 EPSS 0.15%

   Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.

7. CVE-2026-102389 WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

   Published 2026-10-15

   Medium·CVSS 6.5 EPSS 0.21%

   Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.

8. CVE-2026-108486 WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability

   Published 2026-10-12

   Medium·CVSS 5.3 EPSS 0.22%

   Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.

9. CVE-2026-65459 WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

   Published 2026-10-10

   High·CVSS 7.5 EPSS 0.28%

   Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

10. CVE-2026-96341 WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

    Published 2026-10-10

    High·CVSS 8.2 EPSS 0.27%

    Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

11. CVE-2026-102388 WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-10

    High·CVSS 7.1 EPSS 0.14%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

12. CVE-2026-96336 WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

    Published 2026-10-09

    High·CVSS 7.5 EPSS 0.27%

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

13. CVE-2026-106611 WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2026-10-08

    High·CVSS 7.1 EPSS 0.12%

    Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.

14. CVE-2026-96335 WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

    Published 2026-10-07

    High·CVSS 7.5 EPSS 0.20%

    Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.

15. CVE-2026-103075 WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability

    Published 2026-10-07

    Medium·CVSS 4.3 EPSS 0.16%

    Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.

16. CVE-2026-102376 WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability

    Published 2026-09-30

    High·CVSS 7.1 EPSS 0.19%

    Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.

17. CVE-2026-84772 WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability

    Published 2026-09-02

    Medium·CVSS 5.5 EPSS 0.26%

    Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

18. CVE-2026-82220 WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability

    Published 2026-08-28

    Medium·CVSS 5.3 EPSS 0.29%

    Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.

19. CVE-2026-81285 WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability

    Published 2026-08-28

    High·CVSS 7.5 EPSS 0.46%

    Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.

20. CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

    Published 2026-08-20

    Critical·CVSS 9.8 EPSS 0.56%

    Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

21. CVE-2026-28143 WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

    Published 2026-08-06

    High·CVSS 7.1 EPSS 0.25%

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

22. CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

    Published 2026-08-06

    High·CVSS 8.8 EPSS 0.42%

    Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

23. CVE-2026-56071 WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability

    Published 2026-06-25

    High·CVSS 7.1 EPSS 0.25%

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

24. CVE-2026-25431 WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerability

    Published 2026-05-12

    Medium·CVSS 5.3 EPSS 0.23%

    Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hustle: through 7.8.10.1.

25. CVE-2024-45625 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.34.0 - Reflected Cross-Site Scripting

    Published 2024-09-09

    Medium·CVSS 6.1 EPSS 0.43%

    Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.