Sensitive Information Exposure in HubSpot All-In-One Marketing Plugin for WordPress
CVE-2025-11762

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Hubspot All-in-one Marketing – Forms, Popups, Live Chat
Vendor
CVE Published:
24 April 2026

What is CVE-2025-11762?

The HubSpot All-In-One Marketing plugin for WordPress is vulnerable due to a flaw in the leadin/public/admin/class-adminconstants.php file. Authenticated attackers with Contributor-level access can exploit this vulnerability to access sensitive information, specifically a comprehensive list of all installed plugins and their respective versions. This information could be used for reconnaissance, potentially ensuring further attacks against the WordPress installation.

Affected Version(s)

HubSpot All-In-One Marketing – Forms, Popups, Live Chat 0 <= 11.3.32

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://research.cleantalk.org/CVE-2025-11762
https://plugins.trac.wordpress.org/browser/leadin/tags/11...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
.