hubspotdev HubSpot All-In-One Marketing Plugin up to 11.3.62 on WordPress wp_localize_script missing encryption

Summaryinfo

A vulnerability was found in hubspotdev HubSpot All-In-One Marketing Plugin up to 11.3.62. It has been declared as problematic. The affected element is the function wp_localize_script. The manipulation results in missing encryption. This vulnerability is known as CVE-2026-9656. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in hubspotdev HubSpot All-In-One Marketing Plugin up to 11.3.62. It has been classified as problematic. Affected is the function wp_localize_script. The manipulation with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality. CVE summarizes:

The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wp_localize_script() / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's plaintext HubSpot OAuth refresh token exposed via the window.leadinConfig JavaScript object, which can then be used to access or modify data in the connected HubSpot tenant. Although the refresh token is stored at rest with AES-256-CTR encryption, decryption occurs server-side before the plaintext value is passed to wp_localize_script(), rendering the at-rest encryption ineffective against this exposure path.

The advisory is available at wordfence.com. This vulnerability is traded as CVE-2026-9656 since 05/26/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-45152). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• hubspotdev

Name

• HubSpot All-In-One Marketing Plugin

Version

• 11.3.0
• 11.3.1
• 11.3.2
• 11.3.3
• 11.3.4
• 11.3.5
• 11.3.6
• 11.3.7
• 11.3.8
• 11.3.9
• 11.3.10
• 11.3.11
• 11.3.12
• 11.3.13
• 11.3.14
• 11.3.15
• 11.3.16
• 11.3.17
• 11.3.18
• 11.3.19
• 11.3.20
• 11.3.21
• 11.3.22
• 11.3.23
• 11.3.24
• 11.3.25
• 11.3.26
• 11.3.27
• 11.3.28
• 11.3.29
• 11.3.30
• 11.3.31
• 11.3.32
• 11.3.33
• 11.3.34
• 11.3.35
• 11.3.36
• 11.3.37
• 11.3.38
• 11.3.39
• 11.3.40
• 11.3.41
• 11.3.42
• 11.3.43
• 11.3.44
• 11.3.45
• 11.3.46
• 11.3.47
• 11.3.48
• 11.3.49
• 11.3.50
• 11.3.51
• 11.3.52
• 11.3.53
• 11.3.54
• 11.3.55
• 11.3.56
• 11.3.57
• 11.3.58
• 11.3.59
• 11.3.60
• 11.3.61
• 11.3.62

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion