Wedevs vulnerabilities
136 CVEs and advisories name Wedevs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-39520WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerability
- CVE-2026-32485WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability
- CVE-2026-24364WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability
- CVE-2026-2233User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter
- CVE-2026-31917WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability
- CVE-2026-1565User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload
- CVE-2025-14339weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion
- CVE-2026-24944WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerability
- CVE-2025-13921weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update
- CVE-2025-14348weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure
- CVE-2025-14574weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure
- CVE-2025-14047WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
- CVE-2025-68040WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability
- CVE-2025-67546WordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerability
- CVE-2025-12809dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
- CVE-2025-63008WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability
- CVE-2025-12505weDocs <= 2.1.14 - Missing Authorization to Settings Update
- CVE-2025-8994WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'
- CVE-2025-58269WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability
- CVE-2025-58672WordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control Vulnerability
- CVE-2025-58673WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection Vulnerability
- CVE-2025-5931Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation
- CVE-2025-3055WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2025-3054WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2025-47540WordPress weMail plugin <= 1.14.13 - Sensitive Data Exposure Vulnerability
- CVE-2025-39377WordPress Appsero Helper plugin <= 1.3.4 - SQL Injection vulnerability
- CVE-2025-2541WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2025-3100WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2025-32280WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability
- CVE-2025-22649WordPress WP Project Manager plugin <= 2.6.22 - Cross Site Scripting (XSS) vulnerability