Skip to content
Noroxi

wpmudev records

35 published records for vendor wpmudev.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
37.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 19
  3. 22
  4. 23
  5. 24
  6. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

35 records
  • CVE-2017-20206
    39Monitor

    Appointments <= 2.2.1 - Unauthenticated PHP Object Injection

    CriticalCVSS 9.8No exploitEPSS 0%

    wpmudev · appointmentsOct 18, 2025

  • CVE-2022-44581
    39Monitor

    WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    wpmudev · defenderMay 17, 2024

  • CVE-2024-37444
    39Monitor

    WordPress Defender plugin <= 4.7.1 - Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    wpmudev · defenderNov 1, 2024

  • CVE-2023-47189
    39Monitor

    WordPress Defender Security plugin <= 4.2.0 - Masked Login Area View Bypass vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    wpmudev · defenderJun 4, 2024

  • CVE-2017-18510
    35Monitor

    The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.

    HighCVSS 8.8No exploitEPSS 0%

    wpmudev · custom sidebarsAug 14, 2019

  • CVE-2017-18511
    35Monitor

    The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.

    HighCVSS 8.8No exploitEPSS 0%

    wpmudev · custom sidebarsAug 14, 2019

  • CVE-2024-10402
    35Monitor

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation

    HighCVSS 8.8No exploitEPSS 0%

    wpmudev · forminator formsOct 26, 2024

  • CVE-2024-43117
    35Monitor

    WordPress Hummingbird plugin <= 3.9.1 - Cross Site Request Forgery (CSRF) vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    wpmudev · hummingbirdAug 26, 2024

  • CVE-2024-0368
    34Monitor

    Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

    HighCVSS 8.6Proof of conceptEPSS 0%

    wpmudev · hustleMar 13, 2024

  • CVE-2017-15079
    31Monitor

    The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.

    HighCVSS 7.5No exploitEPSS 2%

    wpmudev · smush image compression and optimizationOct 6, 2017

  • CVE-2023-5949
    30Monitor

    SmartCrawl WordPress SEO checker < 3.8.3 - Unauthenticated Password Protected Post Disclosure

    HighCVSS 7.5No exploitEPSS 0%

    wpmudev · smartcrawlDec 18, 2023

  • CVE-2023-51490
    30Monitor

    WordPress Defender Security Plugin <= 4.1.0 is vulnerable to Sensitive Data Exposure

    HighCVSS 7.5No exploitEPSS 0%

    wpmudev · defender securityJan 8, 2024

  • CVE-2025-5341
    25Monitor

    Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters

    MediumCVSS 6.4No exploitEPSS 0%

    wpmudev · forminator formsJun 5, 2025

  • CVE-2022-1009
    24Monitor

    Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 0%

    wpmudev · smush image compression and optimizationMay 30, 2022

  • CVE-2015-10098
    24Monitor

    Broken Link Checker Plugin ui_get_action_links cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    wpmudev · broken link checkerApr 8, 2023

  • CVE-2025-0470
    24Monitor

    Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter

    MediumCVSS 6.1No exploitEPSS 0%

    wpmudev · forminator formsJan 31, 2025

  • CVE-2023-5089
    22Monitor

    Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)

    MediumCVSS 5.3Proof of conceptEPSS 2%

    wpmudev · defender securityOct 16, 2023

  • CVE-2024-3287
    21Monitor

    SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization

    MediumCVSS 5.3No exploitEPSS 0%

    wpmudev · smartcrawl seo checker, analyzer & optimizerMay 2, 2024

  • CVE-2024-6554
    21Monitor

    Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure

    MediumCVSS 5.3No exploitEPSS 0%

    wpmudev · brandaJul 11, 2024

  • CVE-2024-25595
    21Monitor

    WordPress Defender Security plugin <= 4.4.1 - IP Restriction Bypass vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    wpmudev · defenderMay 17, 2024

  • CVE-2024-10580
    21Monitor

    Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission

    MediumCVSS 5.3No exploitEPSS 0%

    wpmudev · hustle – email marketing, lead generation, optins, popupsNov 27, 2024

  • CVE-2024-9700
    21Monitor

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation

    MediumCVSS 5.3No exploitEPSS 0%

    wpmudev · forminator formsOct 31, 2024

  • CVE-2024-6556
    21Monitor

    SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path Disclosure

    MediumCVSS 5.3No exploitEPSS 0%

    wpmudev · smartcrawl seo checker, analyzer & optimizerJul 10, 2024

  • CVE-2023-51542
    21Monitor

    WordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    wpmu dev · brandaJun 4, 2024

  • CVE-2024-5191
    21Monitor

    Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

    MediumCVSS 5.4No exploitEPSS 0%

    wpmudev · brandaJun 21, 2024