Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-08
Hummingbird Performance - Remote Code Execution (CVE-2026-83627)
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a…
PLUGIN
Hummingbird Performance
CVE-2026-83627
Risk Score
Threat Entry
Updated 2026-09-08
Hummingbird Performance - Security Vulnerability (CVE-2026-19224)
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
PLUGIN
Hummingbird Performance
CVE-2026-19224
Risk Score
Threat Entry
Updated 2026-06-17
Hummingbird Performance - Information Disclosure (CVE-2025-14437)
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.
PLUGIN
Hummingbird Performance
CVE-2025-14437
Risk Score