WPMU DEV

The Forminator plugin for WordPress contains an arbitrary shortcode execution vulnerability (CVE-2026-92229) allowing unauthenticated attackers to execute arbitrary shortcodes by leveraging improper input validation.

An unauthenticated remote code execution vulnerability in the Hummingbird WordPress plugin allows attackers to inject and execute arbitrary PHP code via unsanitized cookie headers in the debug log.

An authentication bypass vulnerability in the WPMU DEV Dashboard WordPress plugin allows unauthenticated attackers to forge an administrator session by exploiting flawed HMAC validation in the Hub SSO flow.

The Forminator Forms WordPress plugin (up to v1.57.0.1) is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the Rich-Text Textarea field, allowing malicious script execution in the context of victim browsers.

The Forminator Forms WordPress plugin version 1.56.1 and earlier contains an arbitrary file upload vulnerability allowing unauthenticated remote code execution via insufficient MIME type validation.

An unauthenticated stored XSS vulnerability in Forminator Forms plugin versions 1.56.1 and earlier allows attackers to inject and execute arbitrary web scripts via forged upload records.

An unauthenticated attacker can exploit CVE-2026-11551, a critical privilege escalation vulnerability in the WordPress Branda plugin up to version 3.4.29, by leveraging improper identity validation to change arbitrary user passwords, including administrators, leading to full account takeover and potential compromise of the WordPress site.