SecAlerts
w

wpmu dev

Security Risk Profile

38
/100
low

Security Risk Score

Comprehensive risk assessment based on 54 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from March 15, 2024 to present

54
Total CVEs
21
Critical+High
0
Exploited
15
Unpatched

Threat Assessment

Avg CVSS
6.4
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
15
Critical/High
Risk Level
38/100
low
🆕 1Fresh (<7d)📈 18 in Last 30 Days

Severity Distribution

Critical
5
High
16
Medium
29
Low
3

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
10

Age Distribution

Common Weaknesses (CWE)

1
XSS
11
2
Code Injection
4
3
CSRF
2
4
Path Traversal
2
5
Input Validation
1

Most Affected Products

1. WPMU DEV Forminator16
2. WPMU DEV Forminator Forms12
3. wpmudev Forminator Forms Wordpress5
4. WPMU DEV Hustle4
5. WPMU DEV Broken Link Checker4

Recent Vulnerabilities

See more →
CVE-2026-118169
CVSS 4.9medium

Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter

Oct 28, 2026🔧 No Patch
CVE-2026-110901
CVSS 5.4medium

WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability

Oct 16, 2026🔧 No Patch
CVE-2026-110039
CVSS 2.7low

Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite

Oct 16, 2026🔧 No Patch
CVE-2026-103911
CVSS 6.5medium

Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block

Oct 16, 2026🔧 No Patch
CVE-2026-101335
CVSS 6.5medium

Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags

Oct 16, 2026🔧 No Patch
CVE-2026-96562
CVSS 6.5medium

Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback

Oct 16, 2026🔧 No Patch
CVE-2026-102389
CVSS 6.5medium

WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

Oct 15, 2026🔧 No Patch
CVE-2026-108486
CVSS 5.3medium

WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability

Oct 12, 2026🔧 No Patch
CVE-2026-65459
CVSS 7.5high

WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

Oct 10, 2026🔧 No Patch
CVE-2026-96341
CVSS 8.2high

WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

Oct 10, 2026🔧 No Patch

Monitor wpmu dev in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.

wpmu dev Security Vulnerabilities & Risk Score | 54 CVEs | SecAlerts - SecAlerts