The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure, allowing authenticated attackers with contributor-level access to extract the site's plaintext HubSpot OAuth refresh token. This token can be used to access or modify data in the connected HubSpot tenant. The vulnerability affects all versions up to, and including, 11.3.62. The [truncated]
The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure. Authenticated attackers with Contributor-level access and above can extract a list of all installed plugins and their versions, which can be used for reconnaissance and further attacks. This vulnerability exists in all versions up to, and including, 11.3.32 via the leadin/publi [truncated]
