Tumult Hype Animations
Tumult Hype Animations has 4 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 4 are fixed as of October 2026. Their average CVSS score is 7.3, and the most serious one scores 9.9 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 4 disclosures.
The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Missing Authorization.
Every one of the 4 issues recorded for Tumult Hype Animations has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. Tumult Hype Animations is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.
CVE-2024-11082Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function
Read the full analysisVulnerability Records
Tumult Hype Animations
Author
tumultinc
This plugin allows you to upload your Tumult Hype animations to your WordPress site to easily embed them using shortcodes on posts and pages. You can also copy the embed code to use your WordPress site as a Tumult Hype animation host. For detailed information and support for this plugin, please visit the support forum. If your animation doesn’t show up at all, please first read the following responsive design tips on the forums. Usage In Tumult Hype Professional, Select File > Export as HTML5 > OAM Widget. Note: Do not export with any spaces in your filename or foreign characters or rename your .oam file after export. In the Hype Animations section in the Admin dashboard, click Upload New Animation and select your .oam file. After successful upload, the plugin will generate a shortcode you can use in posts and pages.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C