Vendor

    WPMU DEV

    79 known vulnerabilities in products by WPMU DEV, 0 of them actively exploited (CISA KEV).

    Key figures

    79

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WPMU DEV
    CriticalCVE-2026-15748

    Unrestricted Upload of File with Dangerous Type (CVE-2026-15748)

    		9.8
    HighCVE-2025-6463

    Incsub Forminator: External Control of File Name or Path

    also in 1 other product

    		8.8
    CriticalCVE-2023-4596

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    also in 1 other product

    		9.8
    CriticalCVE-2026-83627

    Code Injection (CVE-2026-83627)

    		9.8
    CriticalCVE-2025-14998

    Authorization Bypass Through User-Controlled Key (CVE-2025-14998)

    		9.8
    HighCVE-2025-14437

    Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File

    		7.5
    CriticalCVE-2026-92229

    Code Injection (CVE-2026-92229)

    		9.1
    HighCVE-2017-15079

    WPMU DEV Download Smush Image Compression and Optimization: Path Traversal

    		7.5
    HighCVE-2026-15459

    WPMU DEV Dashboard: Improper Authentication

    		8.1
    CriticalCVE-2026-11551

    Weak Password Recovery Mechanism for Forgotten Password (CVE-2026-11551)

    		9.8
    MediumCVE-2023-5089

    Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)

    		5.3
    HighCVE-2022-2438

    Broken Link Checker <= 1.11.16 - Authenticated (Admin+) PHAR Deserialization

    also in 1 other product

    		7.2
    CriticalCVE-2026-76581

    WPMU DEV Dashboard: Improper Verification of Cryptographic Signature

    		9.8
    CriticalCVE-2017-20206

    Appointments <= 2.2.1 - Unauthenticated PHP Object Injection

    		9.8
    HighCVE-2026-5192

    Path Traversal (CVE-2026-5192)

    		7.5
    HighCVE-2026-75528

    WPMU DEV Broken Link Checker: Cross-site Scripting

    		7.2
    HighCVE-2026-18323

    Cross-site Scripting (CVE-2026-18323)

    		7.2
    HighCVE-2026-18324

    Cross-site Scripting (CVE-2026-18324)

    		7.2
    HighCVE-2026-92144

    Cross-site Scripting (CVE-2026-92144)

    		7.2
    HighCVE-2024-0368

    Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

    		8.6
    HighCVE-2026-18325

    Cross-site Scripting (CVE-2026-18325)

    		7.2
    HighCVE-2026-18328

    Cross-site Scripting (CVE-2026-18328)

    		7.2
    HighCVE-2026-0911

    Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import

    		7.5
    HighCVE-2026-85235

    Cross-site Scripting (CVE-2026-85235)

    		7.2
    MediumCVE-2026-101335

    Code Injection (CVE-2026-101335)

    		6.5

    All vulnerabilities in search

    News

    Products

    Products by WPMU DEV
    Forminator Forms – Contact Form, Payment Form & Custom Form Builder350
    Forminator Forms100
    Broken Link Checker70
    Branda – White Label & Branding, Free Login Page Customizer50
    Hustle – Email Marketing, Lead Generation, Optins, Popups50
    WPMU DEV Defender Security40
    Branda30
    Defender Security30
    Smartcrawl Seo Checker, Analyzer & Optimizer30