Incsub

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Incsub product.

RSS Feeds for Incsub security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Incsub products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Incsub Sorted by Most Security Vulnerabilities since 2018

Incsub Forminator21 vulnerabilities

Incsub Hummingbird4 vulnerabilities

Incsub Hustle2 vulnerabilities

By the Year

In 2026 there have been 0 vulnerabilities in Incsub. Last year, in 2025 Incsub had 2 security vulnerabilities published. Right now, Incsub is on track to have less security vulnerabilities in 2026 than it did last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	2	8.15
2024	10	6.28
2023	9	6.11
2022	1	4.80
2021	1	4.80
2020	1	5.30
2019	3	8.80

It may take a day or so for new Incsub vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Incsub Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-6464	Jul 02, 2025	PHP Object Injection via entry_delete_upload_files in Forminator Forms <=1.44.2 The Forminator Forms Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticated attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization occurs when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings.	Forminator
CVE-2025-6463	Jul 02, 2025	Forminator <1.44.2 Inf File Delete via entry_delete_upload_files The Forminator Forms Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).	Forminator
CVE-2024-43118	Nov 01, 2024	Missing Auth: WPMU DEV Hummingbird <3.9.1 Exploitable Access Control Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.9.1.	Hummingbird
CVE-2024-45625	Sep 09, 2024	Forminator WP Plugin <1.34.1 XSS via Crafted URL Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.	Forminator
CVE-2024-7389	Aug 02, 2024	Forminator WP Plugin <=1.29.1 Sensitive Info Exposure via HubSpot API Key The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin's HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration.	Forminator
CVE-2024-32792	Jun 09, 2024	WPMU DEV Hummingbird Missing Auth Vulnerability (up to 3.7.3) Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.7.3.	Hummingbird
CVE-2024-28890	Apr 23, 2024	Forminator <1.29.0: Unrestricted File Upload via Form Upload Field Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.	Forminator
CVE-2024-31077	Apr 23, 2024	Forminator SQLi before 1.29.3 allows admin to alter DB & cause DoS Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) condition.	Forminator
CVE-2024-31857	Apr 23, 2024	Forminator <1.15.4 XSS via Widget Component Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser.	Forminator
CVE-2024-1794	Apr 09, 2024	WordPress Forminator <=1.29.0 XSS via Unsanitized Upload The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Forminator