Browse CVEs

HIGH 8.8 CVE-2025-6464 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up… Forminator 1.44.3+ Fix from $1,9502025-07-02 HIGH 8.8 CVE-2025-6463EPSS 12% The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insuffic… Forminator 1.44.3+ Fix from $1,9502025-07-02 HIGH 8.8 CVE-2024-43118 Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbi… Hummingbird 3.9.2+ Fix from $1,9502024-11-01 MEDIUM 6.1 CVE-2024-45625 Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be exec… Forminator 1.34.1+ Fix from $1,6002024-09-09 HIGH 7.5 CVE-2024-7389 The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator… Forminator 1.29.2+ Fix from $1,9502024-08-02 MEDIUM 5.3 CVE-2024-32792 Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbi… Hummingbird 3.7.4+ Fix from $1,6002024-06-09 HIGH 7.2 CVE-2024-31077EPSS 30% Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an admini… Forminator 1.29.3+ Fix from $1,9502024-04-23 MEDIUM 5.4 CVE-2024-31857 Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user infor… Forminator 1.15.4+ Fix from $1,6002024-04-23 MEDIUM 5.3 CVE-2024-28890 Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote at… Forminator 1.29.0+ Fix from $1,6002024-04-23 MEDIUM 5.4 CVE-2024-3053 The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ form… Forminator 1.29.3+ Fix from $1,6002024-04-09 MEDIUM 6.1 CVE-2024-1794 The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and inc… Forminator after 1.29.1 Fix from $1,6002024-04-09 MEDIUM 6.1 CVE-2024-29777 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform F… Forminator 1.29.1+ Fix from $1,6002024-03-27 CRITICAL 9.8 CVE-2023-4596EPSS 13% The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to t… Forminator after 1.24.6 Fix from $2,3002023-08-30 MEDIUM 6.1 CVE-2023-3134 The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated quer… Forminator 1.24.4+ Fix from $1,6002023-07-31 CRITICAL 9.8 CVE-2023-1478 The Hummingbird WordPress plugin before 3.4.2 does not validate the generated file path for page cache files before writing them, leading to a path t… Hummingbird 3.4.2+ Fix from $2,3002023-04-10 MEDIUM 6.1 CVE-2021-36821 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.Th… Forminator 1.14.12+ Fix from $1,6002023-03-16 MEDIUM 5.3 CVE-2018-18576 The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dash… Hustle after 6.0.5 Fix from $1,6002020-03-17 HIGH 8.1 CVE-2015-9455 The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photo… Buddypress Activity Plus 1.6.2+ Fix from $1,9502019-10-07 HIGH 8.8 CVE-2019-11872 The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up wi… Hustle 6.0.8.1+ Fix from $1,9502019-05-29 MEDIUM 6.5 CVE-2019-9568 The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entri… Forminator 1.6+ Fix from $1,6002019-03-04 MEDIUM 6.1 CVE-2019-9567 The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll. Forminator 1.6+ Fix from $1,6002019-03-04