Description
Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data.

This issue affects HubSpot: from n/a through 11.3.51.
Published: 2026-07-01
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in the HubSpot WordPress plugin allows an attacker to retrieve embedded sensitive data that the plugin sends, potentially exposing confidential information that the plugin handles or transmits to HubSpot’s servers. The flaw corresponds to CWE-201, indicating unauthorized disclosure of sensitive information.

Affected Systems

WordPress sites running the HubSpot plugin in any version up to and including 11.3.51 are affected. Versions newer than 11.3.51 are not vulnerable.

Risk and Exploitability

The CVSS score of 7.4 places the issue in the high severity range, and the EPSS score is <1%, indicating limited public exploitation data. It is not listed in the catalog. The vulnerability enables retrieval of embedded sensitive data, which can expose confidential information.

Generated by OpenCVE AI on July 22, 2026 at 14:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the HubSpot WordPress plugin to a version newer than 11.3.51.
  • Update the WordPress core, themes, and other plugins to their latest versions to reduce collateral attack surface.
  • Review and restrict the plugin’s configuration so that outbound data does not include sensitive values and ensure sensitive values are omitted or redacted.

Generated by OpenCVE AI on July 22, 2026 at 14:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Hubspot
Hubspot hubspot
Wordpress
Wordpress wordpress
Vendors & Products Hubspot
Hubspot hubspot
Wordpress
Wordpress wordpress

Wed, 01 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Description Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.
Title WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability
Weaknesses CWE-201
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L'}

Subscriptions

Hubspot Hubspot
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-01T17:59:06.101Z

Reserved: 2026-06-25T08:04:20.945Z

Link: CVE-2026-57736

cve-icon Vulnrichment

Updated: 2026-07-01T17:58:33.521Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-22T14:30:17Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data