The HubSpot All‑In‑One Marketing – Forms, Popups, Live Chat plugin for WordPress leaks the site’s HubSpot OAuth refresh token through the JavaScript object that is rendered with wp_localize_script(). The plaintext token is placed in the global variable window.leadinConfig and is accessible to any authenticated user with contributor-level access or higher. This constitutes a CWE‑200 sensitive information disclosure that allows an attacker to obtain a credential capable of accessing or modifying data in the connected HubSpot tenant. At‑rest encryption of the token is ineffective because the token is decrypted server‑side before being passed to the script, so the exposed token can be used immediately. The vulnerability is present in all released versions of the plugin up to and including 11.3.62. WordPress sites that integrate HubSpot services and use this plugin are vulnerable if they allow contributor or higher roles. The fix is implemented in versions 11.3.64 and later, where the token is removed from the localized script. Although the CVSS score of 4.3 indicates moderate severity and the EPSS score of less than 1 % indicates a low current likelihood of exploitation, the exposed credential gives the attacker a powerful remote credential to the HubSpot environment. The flaw does not appear in the CISA KEV catalog, so no confirmed active exploitation is documented, but the potential impact on data confidentiality and integrity is significant for sites using HubSpot integrations.

The HubSpot All‑In‑One Marketing – Forms, Popups, Live Chat plugin for WordPress, versions up to and including 11.3.62, is affected. Any WordPress site that uses this plugin and allows contributor or higher roles is vulnerable. Upgrading to version 11.3.64 or later removes the exposed script.

The vulnerability has a CVSS score of 4.3, reflecting moderate severity, and an EPSS score of less than 1 %, indicating currently low exploitation probability. However, it requires only authenticated contributor‑level access, which is common in multi‑user sites. The exposed OAuth refresh token is a full credential that, once accessed, can be used to read, create, or modify data in the connected HubSpot tenant. This makes the weakness a significant confidentiality and integrity threat. As it is not listed in CISA KEV, no confirmed active exploitation has been reported, but the potential impact remains high for users who have not mitigated the exposure.