CveMateVulnerability intelligence

WPMU DEV vulnerabilities

30 vulnerabilities

Known vulnerabilities in WPMU DEV products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.

Products

8

Forminator17 vulnerabilities
Broken Link Checker3 vulnerabilities
Defender Security3 vulnerabilities
Branda2 vulnerabilities
Hustle2 vulnerabilities
Defender Security – Malware Scanner, Login Security & Firewall1 vulnerabilities
Smartcrawl1 vulnerabilities
Smush Image Compression And Optimization1 vulnerabilities

CVE-2026-110901wpmu devsmartcrawl3d ago16-10-2026 12:50

Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.CVE-2026-102389wpmu devbroken link checker4d ago15-10-2026 13:00

Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.CVE-2026-108486wordpressforminator+16d ago12-10-2026 17:13

Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.CVE-2021-36821incsubforminator+23y ago16-03-2023 14:45

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.CVE-2022-44581wordpressdefender-security+22y ago17-05-2024 06:27

Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.CVE-2024-31077incsubforminator+22y ago23-04-2024 04:47

Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) condition.CVE-2024-31857incsubforminator+22y ago23-04-2024 04:46

Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser.CVE-2024-25595wordpressdefender-security+22y ago17-05-2024 08:23

Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1.CVE-2024-25592wordpressbroken-link-checker+22y ago15-03-2024 13:56

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Broken Link Checker allows Stored XSS.This issue affects Broken Link Checker: from n/a through 2.2.3.CVE-2024-45625incsubforminator+22y ago09-09-2024 04:44

Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.CVE-2024-28890incsubforminator+22y ago23-04-2024 04:56

Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.CVE-2026-84772wordpressbroken-link-checker+11mo ago02-09-2026 11:37

Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.CVE-2026-65459wordpressforminator+18d ago10-10-2026 19:36

Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.CVE-2026-102376wordpressbranda-white-labeling+118d ago30-09-2026 17:39

Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.CVE-2026-102388wordpressforminator+18d ago10-10-2026 14:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.CVE-2026-25431wordpresswordpress-popup+15mo ago12-05-2026 16:32

Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hustle: through 7.8.10.1.CVE-2026-103075wordpresswordpress-popup+112d ago07-10-2026 09:12

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.CVE-2026-56071wordpressforminator+13mo ago25-06-2026 13:12

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.CVE-2026-66583wordpressforminator+12mo ago20-08-2026 12:06

Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.CVE-2026-106611wordpressforminator+110d ago08-10-2026 13:05

Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.