Wedevs vulnerabilities
136 CVEs and advisories name Wedevs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-78470WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
- CVE-2026-78262WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
- CVE-2026-32478WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability
- CVE-2026-73393WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66466WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability
- CVE-2026-11421ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
- CVE-2026-13110StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action
- CVE-2026-15411StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action
- CVE-2026-13440StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter
- CVE-2026-65492WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-59522WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability
- CVE-2026-15349ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler
- CVE-2026-12418User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter
- CVE-2026-13011ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter
- CVE-2026-12406User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter
- CVE-2026-5459User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite
- CVE-2026-12731weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes
- CVE-2026-12729weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action
- CVE-2026-12734weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute
- CVE-2026-12224Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint
- CVE-2026-57334WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability
- CVE-2026-57322WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-12077Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters
- CVE-2026-12079Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter
- CVE-2022-47150WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2026-4058User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation
- CVE-2026-4834WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter
- CVE-2026-5127User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection
- CVE-2026-25468WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability
- CVE-2026-42412WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability