Wedevs vulnerabilities

Products

• Happy Addons For Elementor 46
• Wp Project Manager 17
• Wp User Frontend 17
• Wp Erp 16
• Project Manager – Ai Powered Project Management, Task Management, Kanban Board & Time Tracker 12
• Wp Erp 11
• Happy Addons For Elementor 9
• Wp Project Manager 9
• Erp: Complete Hr, Accounting & Crm Suite With Woocommerce Crm Support 8
• Dokan Pro 7
• Wedocs: Ai Powered Knowledge Base, Docs, Documentation, Wiki & Ai Chatbot 7
• Erp: Complete Hr, Accounting & Crm Suite Built For Woocommerce 6
• Wemail 6
• User Frontend: Ai Powered Frontend Posting, User Directory, Profile, Membership & User Registration 5
• Subscribe2 – Form, Email Subscribers & Newsletters 4
• Wp User Frontend 4
• Dokan 3
• Storegrowth – Upsell, Bogo, Quick View, Direct Checkout & Side Cart For Woocommerce 3
• Wedocs 3
• Wemail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins For Woocommerce 3
• Woocommerce Conversion Tracking 3
• Wp User Frontend Pro 3
• Appsero Helper 2
• Dokan – Best Woocommerce Multivendor Marketplace Solution – Build Your Own Amazon, Ebay, Etsy 2
• Recaptcha Integration For Wordpress 2
• Subscribe2 2
• Woocommerce Conversion Tracking 2

Newest

• wedevs subscribe2 – form, email subscribers & newsletters Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter CVE-2026-120531 7.2 HighNovember 7, 2026
• wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input CVE-2026-109214 7.2 HighNovember 7, 2026
• wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbot weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute CVE-2026-104760 6.4 MediumNovember 7, 2026
• wedevs wedocs WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability CVE-2026-121767 5.3 MediumNovember 7, 2026
• wedevs wepos – point of sale (pos) for woocommerce & dokan wePOS before 2.0.3 Missing Authorization via payment/process Endpoint CVE-2026-121993 5.3 MediumNovember 4, 2026
• unknown erp: complete hr, accounting & crm suite built for woocommerce WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log CVE-2026-105191 4.3 MediumNovember 4, 2026
• dokan, inc. dokan WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability CVE-2026-119485 5.3 MediumNovember 3, 2026
• dokan, inc. dokan WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability CVE-2026-119487 5.3 MediumNovember 3, 2026
• unknown wemail weMail <= 2.1.6 - Editor+ API Key Disclosure CVE-2026-104648 4.9 MediumNovember 3, 2026
• unknown wemail weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can() CVE-2026-104647 3.8 LowNovember 3, 2026
• wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter CVE-2026-120070 8.8 HighOctober 31, 2026
• wedevs project manager – ai powered project management, task management, kanban board & time tracker Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection CVE-2026-116512 Public exploit 9.8 CriticalOctober 31, 2026
• wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter CVE-2026-103962 6.1 MediumOctober 31, 2026
• wedevs erp: complete hr, accounting & crm suite built for woocommerce ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body CVE-2026-96894 7.2 HighOctober 30, 2026
• wedevs happy addons for elementor WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability CVE-2026-109891 6.4 MediumOctober 29, 2026
• wedevs wp erp WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability CVE-2026-25448 4.3 MediumOctober 29, 2026
• wedevs happy addons for elementor WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-116850 6.5 MediumOctober 29, 2026
• wedevs wp user frontend WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability CVE-2026-52708 4.3 MediumOctober 29, 2026
• wedevs wp user frontend WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability CVE-2026-48884 5.3 MediumOctober 29, 2026
• dokan, inc. dokan WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability CVE-2026-115590 7.2 HighOctober 28, 2026
• wedevs user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter CVE-2026-96574 6.4 MediumOctober 10, 2026
• wedevs happy addons for elementor WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-104393 6.5 MediumOctober 7, 2026
• wedevs storegrowth: smart sales booster for woocommerce | bogo, upsells, direct checkout, quick view, side cart WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-39750 7.1 HighOctober 6, 2026
• wedevs wp user frontend pro WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability CVE-2026-32572 7.1 HighOctober 6, 2026
• unknown wp user frontend WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form CVE-2026-79618 4.3 MediumOctober 2, 2026
• wedevs wp project manager WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability CVE-2026-97281 6.3 MediumOctober 1, 2026
• wedevs wp erp WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability CVE-2026-96346 7.6 HighSeptember 30, 2026
• wedevs wp erp WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability CVE-2026-96343 7.2 HighSeptember 30, 2026
• leevio happy addons for elementor WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-62080 6.5 MediumSeptember 30, 2026
• wedevs wp user frontend WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability CVE-2026-95525 6.5 MediumSeptember 23, 2026
• wedevs wp user frontend WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability CVE-2026-95524 5.3 MediumSeptember 23, 2026
• wedevs wp user frontend WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability CVE-2026-95523 6.5 MediumSeptember 23, 2026
• wedevs wp user frontend WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability CVE-2026-81283 8.8 HighSeptember 2, 2026
• wedevs erp: complete hr, accounting & crm suite built for woocommerce ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment CVE-2026-18080 Public exploit 9.8 CriticalAugust 26, 2026
• wedevs wp project manager pro WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection CVE-2026-78470 6.5 MediumAugust 25, 2026
• wedevs wp project manager WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability CVE-2026-78262 9.8 CriticalAugust 24, 2026
• unknown subscribe2 WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability CVE-2026-73393 7.1 HighAugust 18, 2026
• wedevs storegrowth: smart sales booster for woocommerce | bogo, upsells, direct checkout, quick view, side cart WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability CVE-2026-66466 7.5 HighAugust 13, 2026
• wedevs erp: complete hr, accounting & crm suite built for woocommerce ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter CVE-2026-11421 6.5 MediumAugust 5, 2026
• wedevs storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerce StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via… CVE-2026-13110 5.3 MediumJuly 28, 2026
• wedevs storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerce StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action CVE-2026-15411 5.3 MediumJuly 28, 2026
• wedevs storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerce StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter CVE-2026-13440 7.2 HighJuly 28, 2026
• dokan pro, wedevs dokan pro +1 more WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-65492 7.1 HighJuly 23, 2026
• wedevs wp erp WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability CVE-2026-59522 6.5 MediumJuly 23, 2026
• wedevs erp: complete hr, accounting & crm suite built for woocommerce ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJA… CVE-2026-15349 4.3 MediumJuly 17, 2026
• wedevs user frontend: ai powered frontend posting, user directory, profile builder, membership & user registration User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf… CVE-2026-12418 5.3 MediumJuly 9, 2026
• wedevs erp: complete hr, accounting & crm suite built for woocommerce ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter CVE-2026-13011 6.5 MediumJuly 9, 2026
• wedevs user frontend: ai powered frontend posting, user directory, profile builder, membership & user registration User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter CVE-2026-12406 5.3 MediumJuly 9, 2026
• wedevs user frontend: ai powered frontend posting, user directory, profile builder, membership & user registration User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite CVE-2026-5459 5.3 MediumJuly 8, 2026
• wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbot weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attribut… CVE-2026-12731 6.4 MediumJuly 3, 2026
• Show olderLoading…