# cve.now: Wedevs

The newest entries naming Wedevs as an affected vendor (up to 200), of 136 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121760](https://cve.now/CVE-2026-121760.md): WordPress weDocs plugin \<= 2.6.1 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-120531](https://cve.now/CVE-2026-120531.md): Subscribe2 – Form, Email Subscribers & Newsletters \<= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data\[ip\]' Parameter (CVSS 7.2)
- [CVE-2026-109214](https://cve.now/CVE-2026-109214.md): User Frontend \<= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input (CVSS 7.2)
- [CVE-2026-104760](https://cve.now/CVE-2026-104760.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site… (CVSS 6.4)
- [CVE-2026-121767](https://cve.now/CVE-2026-121767.md): WordPress weDocs plugin \<= 2.6.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-121993](https://cve.now/CVE-2026-121993.md): wePOS before 2.0.3 Missing Authorization via payment/process Endpoint (CVSS 5.3)
- [CVE-2026-119485](https://cve.now/CVE-2026-119485.md): WordPress Dokan plugin \<= 5.3.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-119487](https://cve.now/CVE-2026-119487.md): WordPress Dokan plugin \<= 5.3.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-120070](https://cve.now/CVE-2026-120070.md): User Frontend \<= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post\_content Parameter (CVSS 8.8)
- [CVE-2026-116512](https://cve.now/CVE-2026-116512.md): Project Manager \<= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection (CVSS 9.8)
- [CVE-2026-103962](https://cve.now/CVE-2026-103962.md): User Frontend \<= 4.3.13 - Reflected Cross-Site Scripting via 'field\_attr\[required\]' Parameter (CVSS 6.1)
- [CVE-2026-96894](https://cve.now/CVE-2026-96894.md): ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce \<= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email… (CVSS 7.2)
- [CVE-2026-109891](https://cve.now/CVE-2026-109891.md): WordPress Happy Addons for Elementor plugin \<= 3.50.1 - Broken Access Control vulnerability (CVSS 6.4)
- [CVE-2026-25448](https://cve.now/CVE-2026-25448.md): WordPress WP ERP plugin \<= 1.17.10 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-116850](https://cve.now/CVE-2026-116850.md): WordPress Happy Addons for Elementor plugin \<= 3.50.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-52708](https://cve.now/CVE-2026-52708.md): WordPress WP User Frontend plugin \<= 4.3.13 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-48884](https://cve.now/CVE-2026-48884.md): WordPress WP User Frontend plugin \<= 4.3.13 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-115590](https://cve.now/CVE-2026-115590.md): WordPress Dokan plugin \<= 5.3.1 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-96574](https://cve.now/CVE-2026-96574.md): User Frontend \<= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf\_payment\_method' Parameter (CVSS 6.4)
- [CVE-2026-104393](https://cve.now/CVE-2026-104393.md): WordPress Happy Addons for Elementor plugin \<= 3.50.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-39750](https://cve.now/CVE-2026-39750.md): WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin \<= 2.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-32572](https://cve.now/CVE-2026-32572.md): WordPress WP User Frontend Pro plugin \<= 4.2.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-97281](https://cve.now/CVE-2026-97281.md): WordPress WP Project Manager plugin \<= 4.0.7 - Broken Access Control vulnerability (CVSS 6.3)
- [CVE-2026-96346](https://cve.now/CVE-2026-96346.md): WordPress WP ERP plugin \<= 1.17.9 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-96343](https://cve.now/CVE-2026-96343.md): WordPress WP ERP plugin \<= 1.17.9 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-95525](https://cve.now/CVE-2026-95525.md): WordPress WP User Frontend plugin \<= 4.3.11 - Arbitrary File Deletion vulnerability (CVSS 6.5)
- [CVE-2026-95524](https://cve.now/CVE-2026-95524.md): WordPress WP User Frontend plugin \<= 4.3.11 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2026-95523](https://cve.now/CVE-2026-95523.md): WordPress WP User Frontend plugin \<= 4.3.11 - Bypass Vulnerability vulnerability (CVSS 6.5)
- [CVE-2026-81283](https://cve.now/CVE-2026-81283.md): WordPress WP User Frontend plugin \<= 4.3.10 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-18080](https://cve.now/CVE-2026-18080.md): ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce \<= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment (CVSS 9.8)
- [CVE-2026-78470](https://cve.now/CVE-2026-78470.md): WP Project Manager Pro \<= 4.0.1 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- [CVE-2026-78262](https://cve.now/CVE-2026-78262.md): WordPress WP Project Manager plugin \<= 4.0.6 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-32478](https://cve.now/CVE-2026-32478.md): WordPress WP Project Manager Pro plugin \<= 4.0.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-73393](https://cve.now/CVE-2026-73393.md): WordPress Subscribe2 plugin \<= 10.46 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66466](https://cve.now/CVE-2026-66466.md): WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-11421](https://cve.now/CVE-2026-11421.md): ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support \<= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter (CVSS 6.5)
- [CVE-2026-13110](https://cve.now/CVE-2026-13110.md): StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart \<= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo\_category\_msg\_create AJAX Action (CVSS 5.3)
- [CVE-2026-15411](https://cve.now/CVE-2026-15411.md): StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart \<= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create\_popup AJAX Action (CVSS 5.3)
- [CVE-2026-13440](https://cve.now/CVE-2026-13440.md): StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart \<= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message\_popup' Parameter (CVSS 7.2)
- [CVE-2026-65492](https://cve.now/CVE-2026-65492.md): WordPress Dokan Pro plugin \< 5.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-59522](https://cve.now/CVE-2026-59522.md): WordPress WP ERP plugin \<= 1.17.5 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-15349](https://cve.now/CVE-2026-15349.md): ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce \<= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp\_ajax\_erp-company-location AJAX Handler (CVSS 4.3)
- [CVE-2026-12418](https://cve.now/CVE-2026-12418.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf\_files\_data' Parameter (CVSS 5.3)
- [CVE-2026-13011](https://cve.now/CVE-2026-13011.md): ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support \<= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter (CVSS 6.5)
- [CVE-2026-12406](https://cve.now/CVE-2026-12406.md): User Frontend \<= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach\_id' Parameter (CVSS 5.3)
- [CVE-2026-5459](https://cve.now/CVE-2026-5459.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite (CVSS 5.3)
- [CVE-2026-12731](https://cve.now/CVE-2026-12731.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes (CVSS 6.4)
- [CVE-2026-12729](https://cve.now/CVE-2026-12729.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs\_migrate\_betterdocs\_to\_wedocs AJAX Action (CVSS 4.3)
- [CVE-2026-12734](https://cve.now/CVE-2026-12734.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute (CVSS 6.4)
- [CVE-2026-12224](https://cve.now/CVE-2026-12224.md): Dokan Pro \<= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update\_capabilities REST Endpoint (CVSS 8.8)
- [CVE-2026-57334](https://cve.now/CVE-2026-57334.md): WordPress WP User Frontend plugin \<= 4.3.7 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-57322](https://cve.now/CVE-2026-57322.md): WordPress weMail plugin \<= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-12077](https://cve.now/CVE-2026-12077.md): Dokan Pro \<= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters (CVSS 7.5)
- [CVE-2026-12079](https://cve.now/CVE-2026-12079.md): Dokan Pro \<= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter (CVSS 6.5)
- [CVE-2022-47150](https://cve.now/CVE-2022-47150.md): WordPress WooCommerce Conversion Tracking plugin \<= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2026-4058](https://cve.now/CVE-2026-4058.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation (CVSS 4.3)
- [CVE-2026-4834](https://cve.now/CVE-2026-4834.md): WP ERP Pro \<= 1.5.1 - Unauthenticated SQL Injection via 'search\_key' Parameter (CVSS 7.5)
- [CVE-2026-5127](https://cve.now/CVE-2026-5127.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8)
- [CVE-2026-25468](https://cve.now/CVE-2026-25468.md): WordPress Happy Addons for Elementor plugin \<= 3.20.8 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-42412](https://cve.now/CVE-2026-42412.md): WordPress WP User Frontend plugin \<= 4.3.1 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-39520](https://cve.now/CVE-2026-39520.md): WordPress weDocs plugin \<= 2.1.18 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-32485](https://cve.now/CVE-2026-32485.md): WordPress WP User Frontend plugin \<= 4.2.8 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-24364](https://cve.now/CVE-2026-24364.md): WordPress WP User Frontend plugin \<= 4.2.5 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-2233](https://cve.now/CVE-2026-2233.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post\_id' Parameter (CVSS 5.3)
- [CVE-2026-31917](https://cve.now/CVE-2026-31917.md): WordPress WP ERP plugin \<= 1.16.10 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-1565](https://cve.now/CVE-2026-1565.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.2.8 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2025-14339](https://cve.now/CVE-2025-14339.md): weMail \<= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion (CVSS 6.5)
- [CVE-2026-24944](https://cve.now/CVE-2026-24944.md): WordPress Subscribe2 plugin \<= 10.44 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-13921](https://cve.now/CVE-2025-13921.md): weDocs \<= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update (CVSS 4.3)
- [CVE-2025-14348](https://cve.now/CVE-2025-14348.md): weMail \<= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure (CVSS 5.3)
- [CVE-2025-14574](https://cve.now/CVE-2025-14574.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.1.15 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-14047](https://cve.now/CVE-2025-14047.md): WP User Frontend \<= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion (CVSS 5.3)
- [CVE-2025-68040](https://cve.now/CVE-2025-68040.md): WordPress WP Project Manager plugin \<= 3.0.1 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2025-67546](https://cve.now/CVE-2025-67546.md): WordPress WP ERP plugin \<= 1.16.6 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2025-12809](https://cve.now/CVE-2025-12809.md): dokan pro \<= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-63008](https://cve.now/CVE-2025-63008.md): WordPress WP ERP plugin \<= 1.16.7 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-12505](https://cve.now/CVE-2025-12505.md): weDocs \<= 2.1.14 - Missing Authorization to Settings Update (CVSS 5.4)
- [CVE-2025-8994](https://cve.now/CVE-2025-8994.md): WP Project Manager \<= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed\_at\_operator' (CVSS 6.5)
- [CVE-2025-58269](https://cve.now/CVE-2025-58269.md): WordPress WP Project Manager Plugin \<= 2.6.25 - Sensitive Data Exposure Vulnerability (CVSS 5.3)
- [CVE-2025-58672](https://cve.now/CVE-2025-58672.md): WordPress WP User Frontend Plugin \<= 4.1.12 - Broken Access Control Vulnerability (CVSS 5.4)
- [CVE-2025-58673](https://cve.now/CVE-2025-58673.md): WordPress WP User Frontend Plugin \<= 4.1.12 - Content Injection Vulnerability (CVSS 5.4)
- [CVE-2025-5931](https://cve.now/CVE-2025-5931.md): Dokan Pro \<= 4.0.5 - Authenticated (Vendor+) Privilege Escalation (CVSS 8.8)
- [CVE-2025-3055](https://cve.now/CVE-2025-3055.md): WP User Frontend Pro \<= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1)
- [CVE-2025-3054](https://cve.now/CVE-2025-3054.md): WP User Frontend Pro \<= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2025-47540](https://cve.now/CVE-2025-47540.md): WordPress weMail plugin \<= 1.14.13 - Sensitive Data Exposure Vulnerability (CVSS 5.3)
- [CVE-2025-39377](https://cve.now/CVE-2025-39377.md): WordPress Appsero Helper plugin \<= 1.3.4 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-2541](https://cve.now/CVE-2025-2541.md): WP Project Manager \<= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2025-3100](https://cve.now/CVE-2025-3100.md): WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts \<= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2025-32280](https://cve.now/CVE-2025-32280.md): WordPress WP Project Manager plugin \< 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-22649](https://cve.now/CVE-2025-22649.md): WordPress WP Project Manager plugin \<= 2.6.22 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-30896](https://cve.now/CVE-2025-30896.md): WordPress WP ERP plugin \<= 1.13.4 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-13436](https://cve.now/CVE-2024-13436.md): Appsero Helper \<= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-11582](https://cve.now/CVE-2024-11582.md): Subscribe2 – Form, Email Subscribers & Newsletters \<= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter (CVSS 7.2)
- [CVE-2024-13500](https://cve.now/CVE-2024-13500.md): WP Project Manager \<= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter (CVSS 6.5)
- [CVE-2024-13752](https://cve.now/CVE-2024-13752.md): WP Project Manager \<= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update (CVSS 6.5)
- [CVE-2024-12195](https://cve.now/CVE-2024-12195.md): WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts \<= 2.6.16 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- [CVE-2023-45765](https://cve.now/CVE-2023-45765.md): WordPress WP ERP plugin \<= 1.12.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-45002](https://cve.now/CVE-2023-45002.md): WordPress WP User Frontend plugin \<= 3.6.8 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-10548](https://cve.now/CVE-2024-10548.md): WP Project Manager \<= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API (CVSS 6.5)
- [CVE-2023-40003](https://cve.now/CVE-2023-40003.md): WordPress WP Project Manager plugin \<= 2.6.7 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2024-12015](https://cve.now/CVE-2024-12015.md): SQL Injection in WordPress Project Manager Plugin (CVSS 7.7)
- [CVE-2024-10520](https://cve.now/CVE-2024-10520.md): WP Project Manager \<= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion (CVSS 5.3)
- [CVE-2024-10174](https://cve.now/CVE-2024-10174.md): WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts \<= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass (CVSS 7.3)
- [CVE-2024-8739](https://cve.now/CVE-2024-8739.md): ReCaptcha Integration for WordPress \<= 1.2.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-47640](https://cve.now/CVE-2024-47640.md): WordPress WP ERP plugin \<= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-38693](https://cve.now/CVE-2024-38693.md): WordPress WP User Frontend plugin \<= 4.0.7 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-43238](https://cve.now/CVE-2024-43238.md): WordPress weMail plugin \<= 1.14.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-37946](https://cve.now/CVE-2024-37946.md): WordPress ReCaptcha Integration for WordPress plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-6666](https://cve.now/CVE-2024-6666.md): WP ERP \<= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor\_id (CVSS 8.8)
- [CVE-2024-3922](https://cve.now/CVE-2024-3922.md): Dokan Pro \<= 3.10.3 - Unauthenticated SQL Injection (CVSS 10.0)
- [CVE-2024-34822](https://cve.now/CVE-2024-34822.md): WordPress weMail plugin \<= 1.14.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-34442](https://cve.now/CVE-2024-34442.md): WordPress weDocs plugin \<= 2.1.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2023-52217](https://cve.now/CVE-2023-52217.md): WordPress WooCommerce Conversion Tracking plugin \<= 2.0.11 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-47682](https://cve.now/CVE-2023-47682.md): WordPress WP User Frontend plugin \<= 3.6.5 - Authenticated Privilege Escalation vulnerability (CVSS 7.2)
- [CVE-2024-1173](https://cve.now/CVE-2024-1173.md): WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting \<= 1.13.1 - Authenticated (AccountingManager+) SQL Injection (CVSS 7.2)
- [CVE-2024-0952](https://cve.now/CVE-2024-0952.md): WP ERP \<= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id (CVSS 7.2)
- [CVE-2024-0956](https://cve.now/CVE-2024-0956.md): WP ERP \<= 1.13.0 - Authenticated (AccountingManager+) SQL Injection (CVSS 4.9)
- [CVE-2024-0609](https://cve.now/CVE-2024-0609.md): WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting \<= 1.13.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-0608](https://cve.now/CVE-2024-0608.md): WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting \<= 1.13.1 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- [CVE-2024-0913](https://cve.now/CVE-2024-0913.md): WP ERP \<= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection (CVSS 7.2)
- [CVE-2024-24711](https://cve.now/CVE-2024-24711.md): WordPress WooCommerce Conversion Tracking plugin \<= 2.0.11 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-6632](https://cve.now/CVE-2023-6632.md): Happy Addons for Elementor \<= 3.9.1.1 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-21747](https://cve.now/CVE-2024-21747.md): WordPress WP ERP Plugin \<= 1.12.8 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2023-26525](https://cve.now/CVE-2023-26525.md): WordPress Dokan Plugin \<= 3.7.12 is vulnerable to SQL Injection (CVSS 7.1)
- [CVE-2023-34382](https://cve.now/CVE-2023-34382.md): WordPress Dokan Plugin \<= 3.7.19 is vulnerable to PHP Object Injection (CVSS 4.4)
- [CVE-2023-49860](https://cve.now/CVE-2023-49860.md): WordPress WP Project Manager Plugin \<= 2.6.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-34383](https://cve.now/CVE-2023-34383.md): WordPress WP Project Manager Plugin \<= 2.6.0 is vulnerable to SQL Injection (CVSS 8.5)
- [CVE-2023-3636](https://cve.now/CVE-2023-3636.md): WP Project Manager \<= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
- [CVE-2023-34008](https://cve.now/CVE-2023-34008.md): WordPress WP ERP Plugin \<= 1.12.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-28989](https://cve.now/CVE-2023-28989.md): WordPress Happy Addons for Elementor Plugin \<= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2020-36745](https://cve.now/CVE-2020-36745.md): WP Project Manager \<= 2.4.0 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2020-36735](https://cve.now/CVE-2020-36735.md): WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting \<= 1.6.3 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2023-1844](https://cve.now/CVE-2023-1844.md): Subscribe2 \<= 10.40 - Missing Authorization (CVSS 4.3)
- [CVE-2023-3407](https://cve.now/CVE-2023-3407.md): Subscribe2 \<= 10.40 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2021-36826](https://cve.now/CVE-2021-36826.md): WordPress WP Project Manager plugin \<= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4)
- [CVE-2021-24292](https://cve.now/CVE-2021-24292.md): Happy Addons for Elementor Free \< 2.24.0 and Pro \< 1.17.0 - Contributor+ Stored XSS (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wedevs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.