Threat database

CVE-2026-110901 is an authorization bypass vulnerability in WPMU DEV SmartCrawl SEO plugin versions before 3.17.1. It arises from incorrectly configured access control security levels that allow an attacker with limited privileges to exploit a user-controlled key to bypass authorization checks. The vulnerability has a medium severity with a CVSS score of 5.4.

CVE-2026-102389 is a code injection vulnerability in the WPMU DEV Broken Link Checker plugin affecting versions from the initial release up to 2.4.14.1. This vulnerability allows an attacker to inject code due to improper control over code generation. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. It requires no privileges but user interaction is needed. There is no information about an official patch or fix available at this time.

CVE-2026-108486 is a missing authorization vulnerability in the WPMU DEV Forminator plugin affecting versions from initial release up to 1.58.0. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3, indicating limited impact primarily on confidentiality without affecting integrity or availability.

CVE-2026-65459 is a high-severity vulnerability in WPMU DEV's Forminator plugin versions up to 1.57.3. It involves missing authorization controls allowing unauthenticated attackers to arbitrarily delete content. This flaw impacts availability but does not affect confidentiality or integrity. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-96341 is a high-severity vulnerability in WPMU DEV Forminator that allows incorrect privilege assignment leading to privilege escalation. It affects Forminator versions from the initial release up to 1.57.3. The vulnerability can be exploited remotely without authentication and requires no user interaction. The impact includes unauthorized modification of data, but does not affect confidentiality or availability.

CVE-2026-102388 is a stored cross-site scripting (XSS) vulnerability in the WPMU DEV Forminator plugin. It affects versions from the initial release up to 1.57.3. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The CVSS score is 7.1, indicating a high severity level with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

CVE-2026-96336 is an authentication bypass vulnerability in WPMU DEV Forminator that allows identity spoofing. It affects versions from the initial release up to 1.57.2. This flaw enables attackers to bypass authentication mechanisms without user interaction, potentially leading to unauthorized actions. The vulnerability has a high severity rating with a CVSS score of 7.5. No official patch or remediation information is provided in the available data.

Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.

CVE-2026-96335 is a Missing Authorization vulnerability in the WPMU DEV Forminator plugin. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability affects Forminator versions up to and including 1.57.2. The CVSS v3.1 base score is 7.5, indicating a high severity issue with no required privileges or user interaction for exploitation. No patch or official remediation information is currently provided.

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.

Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.

Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

CVE-2026-82220 is an authentication bypass vulnerability in WPMU DEV's Forminator plugin affecting versions up to 1.57.1. It is classified under CWE-294, indicating an authentication bypass issue. The vulnerability allows unauthenticated attackers to bypass authentication mechanisms via a capture-replay method. The CVSS v3.1 base score is 5.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-81285 is a high-severity vulnerability in WPMU DEV's Smush Image Compression and Optimization plugin versions up to 4.2.0. It allows unauthenticated attackers to cause a denial of service by allocating resources without limits or throttling. This vulnerability does not impact confidentiality or integrity but can disrupt availability.

CVE-2026-66583 is a critical vulnerability in WPMU DEV's Forminator plugin, affecting versions up to and including 1.57.0. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability.

CVE-2026-28143 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability affecting WPMU DEV's Forminator plugin versions up to and including 1.56.0. This vulnerability allows attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. Users should monitor vendor advisories for updates and apply patches once available.

CVE-2026-28111 is a high-severity vulnerability in WPMU DEV's Forminator plugin, affecting versions up to and including 1.56.0. It involves incorrect privilege assignment that allows users with Contributor-level access to escalate their privileges. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently documented. There are no known exploits in the wild at this time.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through <= 1.55.0.2.