HubSpot All-In-One Marketing – Forms, Popups, Live Chat

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   HubSpot All-In-One Marketing – Forms, Popups, Live Chat

Information

Software Type Plugin
Software Slug leadin (view on wordpress.org)
Software Status Active
Software Author hubspotdev
Software Website www.hubspot.com
Software Downloads 20,691,501
Software Active Installs 200,000
Software Record Last Updated August 19, 2026

5 Vulnerabilities

Submit a Vulnerability
HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script
4.3
CVE-2026-9656
Jul 16, 2026
Researcher: anhcd05
HubSpot All-In-One Marketing – Forms, Popups, Live Chat <= 11.3.55 - Authenticated (Contributor+) Information Exposure
4.3
CVE-2026-57736
Jul 1, 2026
Researcher: Jakub Herman
HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure
4.3
CVE-2025-11762
Apr 23, 2026
Researcher: Dmitrii Ignatyev
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget
6.4
CVE-2024-5879
Aug 29, 2024
Researcher: wesley (wcraft)
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 8.8.13 - Server Side Request Forgery
8.1
CVE-2022-1239
Apr 11, 2022
Researcher: Brandon James Roldan (tomorrowisnew)
Title Status CVE ID CVSS Researchers Date
HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script Patched CVE-2026-9656 4.3 anhcd05 July 16, 2026
HubSpot All-In-One Marketing – Forms, Popups, Live Chat <= 11.3.55 - Authenticated (Contributor+) Information Exposure Patched CVE-2026-57736 4.3 Jakub Herman July 1, 2026
HubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure Patched CVE-2025-11762 4.3 Dmitrii Ignatyev April 23, 2026
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget Patched CVE-2024-5879 6.4 wesley (wcraft) August 29, 2024
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 8.8.13 - Server Side Request Forgery Patched CVE-2022-1239 8.1 Brandon James Roldan (tomorrowisnew) April 11, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation