Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

wpmudev — Vulnerabilities & Security Advisories 52

Browse all 52 CVE security advisories affecting wpmudev. AI-powered Chinese analysis, POCs, and references for each vulnerability.

WPMU DEV operates as a provider of WordPress plugins, themes, and hosting services, primarily targeting website administrators and developers seeking integrated digital asset management solutions. Security audits have identified forty-one Common Vulnerabilities and Exposures (CVEs) associated with its ecosystem, reflecting a pattern of recurring issues within its software portfolio. Historically, these vulnerabilities predominantly manifest as remote code execution, cross-site scripting, and privilege escalation flaws, often stemming from insufficient input validation and inadequate access controls in plugin code. While no single catastrophic data breach has been publicly documented as a direct result of these specific CVEs, the high volume of disclosed issues indicates systemic weaknesses in the development lifecycle. The company has responded to these findings through regular patch releases, yet the persistent nature of these defects suggests ongoing challenges in maintaining rigorous security standards across its diverse range of WordPress extensions.

Found 30 results / 52 Clear Filters
Top products by wpmudev: Forminator Forms – Contact Form, Payment Form & Custom Form Builder Hustle – Email Marketing, Lead Generation, Optins, Popups Branda – White Label & Branding, Free Login Page Customizer Broken Link Checker SmartCrawl SEO checker, analyzer & optimizer WPMU DEV Dashboard Defender Security – Malware Scanner, Login Security & Firewall Smush – Image Optimization, Compression, Lazy Load, WebP & CDN Appointments Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
CVE ID Title CVSS Severity Published
CVE-2026-18324 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 7.2 High 2026-08-28
CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 7.2 High 2026-08-25
CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 7.2 High 2026-08-25
CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-434 9.8 Critical 2026-08-18
CVE-2026-12998 Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-639 5.3 Medium 2026-08-16
CVE-2026-18325 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 7.2 High 2026-08-06
CVE-2026-6214 Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-862 6.5 Medium 2026-05-07
CVE-2026-6222 Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-862 5.3 Medium 2026-05-07
CVE-2026-5192 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-22 7.5 High 2026-05-05
CVE-2026-2729 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-639 5.3 Medium 2026-05-05
CVE-2026-2002 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 4.4 Medium 2026-02-17
CVE-2025-14782 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-862 5.3 Medium 2026-01-09
CVE-2025-7638 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-89 4.9 Medium 2025-07-18
CVE-2025-6464 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-502 7.5 High 2025-07-02
CVE-2025-6463 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-73 8.8 High 2025-07-02
CVE-2025-5341 Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 6.4 Medium 2025-06-05
CVE-2025-3487 Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 6.4 Medium 2025-04-17
CVE-2025-3479 Forminator <= 1.42.0 - Order Replay Vulnerability — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-354 5.3 Medium 2025-04-17
CVE-2025-0469 Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 6.4 Medium 2025-02-27
CVE-2025-0470 Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 6.1 Medium 2025-01-31
CVE-2024-9700 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-639 5.3 Medium 2024-10-31
CVE-2024-10402 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-862 7.5 High 2024-10-26
CVE-2024-9351 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-352 4.3 Medium 2024-10-17
CVE-2024-9352 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-352 4.3 Medium 2024-10-17
CVE-2024-7389 Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-522 7.5 High 2024-08-02
CVE-2024-1794 Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 7.2 High 2024-04-09
CVE-2024-3053 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-79 6.4 Medium 2024-04-09
CVE-2023-6133 Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-434 6.6 Medium 2023-11-15
CVE-2023-4596 Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-434 9.8 Critical 2023-08-30
CVE-2021-4417 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass — Forminator Forms – Contact Form, Payment Form & Custom Form Builder CWE-352 5.4 Medium 2023-07-12

This page lists every published CVE security advisory associated with wpmudev. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.