Vendor

    WPMU DEV

    27 known vulnerabilities in products by WPMU DEV, 0 of them actively exploited (CISA KEV).

    Key figures

    27

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WPMU DEV
    HighCVE-2025-6463

    Incsub Forminator: External Control of File Name or Path

    also in 1 other product

    		8.8
    CriticalCVE-2023-4596

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    also in 1 other product

    		9.8
    HighCVE-2024-31077

    WPMU DEV Forminator: SQL Injection

    also in 1 other product

    		7.2
    MediumCVE-2023-3134

    Forminator < 1.24.4 - Reflected XSS

    		6.1
    HighCVE-2019-11872

    Incsub Hustle: security vulnerability

    		8.8
    CriticalCVE-2023-1478

    Hummingbird < 3.4.2 - Unauthenticated Path Traversal

    		9.8
    MediumCVE-2022-0994

    Hummingbird < 3.3.2 - Admin+ Stored Cross-Site Scripting

    		4.8
    MediumCVE-2019-9568

    Incsub Forminator: SQL Injection

    		6.5
    MediumCVE-2019-9567

    Incsub Forminator: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2018-18576

    Incsub Hustle: Path Traversal

    		5.3
    HighCVE-2025-6464

    Incsub Forminator: Deserialization of Untrusted Data

    also in 1 other product

    		7.5
    HighCVE-2024-7389

    Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

    also in 1 other product

    		7.5
    MediumCVE-2023-6133

    Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

    also in 1 other product

    		6.6
    HighCVE-2015-9455

    Incsub Buddypress-activity-plus: Path Traversal

    		8.1
    HighCVE-2024-1794

    Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

    also in 1 other product

    		7.2
    MediumCVE-2024-28890

    WPMU DEV Forminator: Information Disclosure

    also in 1 other product

    		5.3
    MediumCVE-2024-31857

    WPMU DEV Forminator: Cross-Site Scripting (XSS)

    also in 1 other product

    		5.4
    HighCVE-2024-29777

    WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability

    also in 1 other product

    		7.1
    MediumCVE-2024-45625

    WPMU DEV Forminator: Cross-Site Scripting (XSS)

    also in 1 other product

    		6.1
    HighCVE-2021-36821

    WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

    also in 1 other product

    		7.1
    HighCVE-2024-43118

    WordPress Hummingbird plugin <= 3.9.1 - Broken Access Control vulnerability

    also in 1 other product

    		4.3
    MediumCVE-2024-3053

    Incsub Forminator: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2021-24700

    Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting

    		4.8
    MediumCVE-2021-4417

    Incsub Forminator: Cross-Site Request Forgery (CSRF)

    also in 1 other product

    		5.4
    MediumCVE-2023-5119

    Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting

    		4.8

    All vulnerabilities in search

    Products

    Products by WPMU DEV
    Forminator Forms200
    Hummingbird40