PatchTheCVEwpmudev vulnerabilities
Recent CVEs affecting wpmudev products. 16 tracked.
wpmudev has 16 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 16. Most recent: 2025-10-18. Highest priority: CVE-2017-20206 (score 53/100).
- CVE-2025-5341 MEDIUM 6.4 UPGRADE The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to
- CVE-2025-3487 MEDIUM 6.4 UPGRADE The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to
- CVE-2025-3479 MEDIUM 5.3 UPGRADE The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to
- CVE-2025-0470 MEDIUM 6.1 UPGRADE The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to
- CVE-2025-0469 MEDIUM 6.4 UPGRADE The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to
- CVE-2024-9700 MEDIUM 5.3 UPGRADE The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to
- CVE-2024-9352 MEDIUM 4.3 UPGRADE The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to
- CVE-2024-9351 MEDIUM 4.3 UPGRADE The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to
- CVE-2024-8492 MEDIUM 4.8 UPGRADE The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allo
- CVE-2024-7052 MEDIUM 4.8 UPGRADE The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which
- CVE-2024-6554 MEDIUM 5.3 UPGRADE The Branda – White Label WordPress, Custom Login Page Customizer plugin for WordPress is vulnerable to Full Pa
- CVE-2024-43117 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird h
- CVE-2024-37444 MEDIUM 5.3 UPGRADE Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defende
- CVE-2024-37239 MEDIUM 5.9 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV
- CVE-2024-10402 HIGH 7.5 UPGRADE The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to
- CVE-2017-20206 CRITICAL 9.8 UPGRADE The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including,
FAQ
How do I fix wpmudev vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is wpmudev being exploited right now?
None of the tracked wpmudev CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which wpmudev CVE should I patch first?
CVE-2017-20206 currently ranks highest (53/100): The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, .