WordPress security by component
HubSpot All-In-One Marketing – Forms, Popups, Live Chat
Plugin description
HubSpot All-In-One Marketing – Forms, Popups, Live Chat is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published Jul 17, 2026; the highest CVE/CNA score is 7.4.
Plugin slug:
leadinLatest vulnerability
CVE-2026-9656: HubSpot All-In-One Marketing – Forms, Popups, Live Chat: Sensitive information exposure
HubSpot All-In-One Marketing – Forms, Popups, Live Chat is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 11.3.62.
| Safe version |
|
||
|---|---|---|---|
| Jul 17, 2026 |
CVE-2026-9656
HubSpot All-In-One Marketing – Forms, Popups, Live Chat: Sensitive information exposure
HubSpot All-In-One Marketing – Forms, Popups, Live Chat is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 11.3.62.
|
> 11.3.62 |
CVE4.3
NVDPending
|
| Jul 01, 2026 |
CVE-2026-57736
HubSpot: A security weakness
HubSpot is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 11.3.51.
|
> 11.3.51 |
CVE7.4
NVDPending
|
| Apr 24, 2026 |
CVE-2025-11762
HubSpot All-In-One Marketing – Forms, Popups, Live Chat: Sensitive information exposure
HubSpot All-In-One Marketing – Forms, Popups, Live Chat is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 11.3.32.
|
> 11.3.32 |
CVE4.3
NVDPending
|
| Aug 30, 2024 |
CVE-2024-5879
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics: Cross-site scripting
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|