Vendor
wedevs
138 known vulnerabilities.
wedevs at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 11 | 0 |
| Oct 2026 | 15 | 1 |
| Sep 2026 | 6 | 0 |
| Aug 2026 | 6 | 2 |
| Jul 2026 | 14 | 0 |
| Jun 2026 | 6 | 0 |
| May 2026 | 3 | 0 |
| Apr 2026 | 2 | 0 |
| Mar 2026 | 4 | 0 |
| Feb 2026 | 3 | 0 |
| Jan 2026 | 4 | 0 |
| Dec 2025 | 5 | 0 |
| Nov 2025 | 1 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 3 | 0 |
| Aug 2025 | 1 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 2 | 0 |
| May 2025 | 1 | 0 |
| Apr 2025 | 4 | 0 |
| Mar 2025 | 3 | 0 |
| Feb 2025 | 3 | 0 |
| Jan 2025 | 3 | 0 |
| Dec 2024 | 3 | 0 |
Most common weaknesses
Products
138 results · Feed
-
Medium 4.3
WP ERP through 1.17.11 Incorrect Authorization via HRM Job-Info AJAX Handlers
weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their ow…
-
Medium 4.3
WordPress Happy Addons for Elementor plugin <= 3.51.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.
-
Medium 6.5
WordPress Happy Addons for Elementor plugin <= 3.51.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.
-
High 7.5
WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.
-
High 7.2
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter
The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This …
-
High 7.2
User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<taxonomy_field_name> (default: 'category')' paramet…
-
Medium 6.4
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute in all versions up to, and including, 2.6.1 due to insufficient input saniti…
-
Medium 5.3
WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.
-
Medium 4.3
wePOS before 2.0.3 Missing Authorization via payment/process Endpoint
wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order…
-
Medium 5.3
WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.
-
Medium 5.3
WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.
-
High 8.8
User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` …
-
Critical 9.8CVE-2026-116512 Public exploit
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsaniti…
-
Medium 6.1
User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions u…
-
High 7.2
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escapin…
-
Medium 6.4
WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
-
Medium 4.3
WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10.
-
Medium 6.5
WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
-
Medium 4.3
WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
-
Medium 5.3
WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
-
High 7.2
WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
-
Medium 6.4
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to…
-
Medium 6.5
WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.
-
High 7.1
WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
-
High 7.1
WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
-
Medium 6.3
WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability
Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.
-
High 7.6
WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability
Author SQL Injection in WP ERP <= 1.17.9 versions.
-
High 7.2
WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
-
Medium 6.5
WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.
-
Medium 5.3
WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
-
Medium 6.5
WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
-
High 8.8
WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.
-
Critical 9.8CVE-2026-18080 Public exploit
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension vali…
-
Medium 6.5
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it …
-
Critical 9.8
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
-
High 7.1
WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
-
High 7.5
WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
-
Medium 6.5
ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied p…
-
Medium 5.3
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action
The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered for both authenticat…
-
Medium 5.3
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action
The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifyi…