Hubspot All In One Marketing – Forms, Popups, Live Chat
Approved changes feed: RSS · Atom
cpe:2.3:a:hubspotdev:hubspot_all-in-one_marketing_–_forms,_popups,_live_chat:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Hubspotdev (dd1cd096-37e6-5a8f-9718-9ff818618154) |
|---|---|
| Product | Hubspot All In One Marketing – Forms, Popups, Live Chat (3ae5c3eb-9c71-57a7-9314-6f35d7aeab11) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9656 |
vulnerable | 2026-07-29 01:12:09.487491 |
HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script
MEDIUM (4.3)
The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wp_localize_script() / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's plaintext HubSpot OAuth refresh token exposed via the window.leadinConfig JavaScript object, which can then be used to access or modify data in the connected HubSpot tenant. Although the refresh token is stored at rest with AES-256-CTR encryption, decryption occurs server-side before the plaintext value is passed to wp_localize_script(), rendering the at-rest encryption ineffective against this exposure path.
Published: 2026-07-17T06:53:26.239Z
Updated: 2026-07-17T11:59:46.332Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11762 |
vulnerable | 2026-06-08 07:04:28.891959 |
HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure
MEDIUM (4.3)
The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks.
Published: 2026-04-24T07:45:06.751Z
Updated: 2026-04-24T18:17:28.206Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5879 |
vulnerable | 2026-06-08 06:56:17.676318 |
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget
MEDIUM (6.4)
The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2024-08-30T04:29:57.206Z
Updated: 2026-04-08T17:14:46.249Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.