WordPress CVEs

Description

The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks.

Affected WordPress components

• HubSpot All-In-One Marketing – Forms, Popups, Live Chat Plugin · leadin
  Confirmed match Active
  Up to and including 11.3.32
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• hubspotdev HubSpot All-In-One Marketing – Forms, Popups, Live Chat — Up to and including 11.3.32

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/leadin/tags/11.3.33/public/admin/class-adminconstants.php
• research.cleantalk.org https://research.cleantalk.org/CVE-2025-11762
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8c62e6-f459-433a-b0c4-c79285ea7fe9?source=cve
• nvd.nist.gov Official NVD record