Vendor

wedevs

138 known vulnerabilities.

Products

WP User Frontend 15 Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 12 WP ERP 11 WP Project Manager 9 ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support 8 Happy Addons for Elementor 8 weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot 7 Dokan Pro 7 ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce 5 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration 5 Subscribe2 – Form, Email Subscribers & Newsletters 4 weMail 4 weDocs 4 User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission 4 WP User Frontend Pro 3 StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce 3 WooCommerce Conversion Tracking 3 Dokan 3 User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration 3 ReCaptcha Integration for WordPress 2 weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce 2 Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy 2 Appsero Helper 2 Subscribe2 2 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart 2 WP Project Manager Pro 1 WP ERP Pro 1 WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting 1 Happy Addons Pro for Elementor 1 WP Project Manager (WordPress plugin) 1 Happy Addons for Elementor Pro 1 wePOS – Point Of Sale (POS) for WooCommerce & Dokan 1 ERP 1 WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts 1

All Critical High Medium Low Exploited only Public exploit

138 results · Feed

High 7.2

CVE-2024-0609

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in all versions up to, and including, 1.13.1 due to insufficient inp…

wedevs ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Web / CMS

Mar 29, 2024
High 7.2

CVE-2024-0913

WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to, and includ…

wedevs ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Web / CMS

Mar 29, 2024
Medium 4.3

CVE-2024-24711

WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.

wedevs WooCommerce Conversion Tracking Web / CMS

Mar 26, 2024
Medium 6.1

CVE-2023-6632

Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting

The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 (versions up to 2.9.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and outpu…

wedevs thehappymonster Happy Addons for Elementor Happy Addons for Elementor Pro Web / CMS

Jan 11, 2024
High 7.6

CVE-2024-21747

WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with rec…

wedevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Web / CMS

Jan 8, 2024
High 7.1

CVE-2023-26525

WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor …

wedevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy Web / CMS

Dec 20, 2023
Medium 4.4

CVE-2023-34382

WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay,…

wedevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy Web / CMS

Dec 19, 2023
Medium 6.5

CVE-2023-49860

WordPress WP Project Manager Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project…

wedevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts

Dec 14, 2023
High 8.5

CVE-2023-34383

WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0.

wedevs WP Project Manager

Nov 3, 2023
High 8.8

CVE-2023-3636

WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation

The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This makes it possible for authenticated attackers, with minimal p…

wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Web / CMS

Aug 31, 2023
High 7.1

CVE-2023-34008

WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions.

wedevs WP ERP

Aug 30, 2023
Medium 4.3

CVE-2023-28989

WordPress Happy Addons for Elementor Plugin <= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions.

wedevs Happy Addons for Elementor

Jul 10, 2023
Medium 4.3

CVE-2020-36745

WP Project Manager <= 2.4.0 - Cross-Site Request Forgery Bypass

The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due to missing or incorrect nonce validation on the do_updates() function. This makes it possible for unauthenticated atta…

wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Web / CMS

Jul 1, 2023
Medium 4.3

CVE-2020-36735

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.6.3 - Cross-Site Request Forgery Bypass

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.3. This is due to missing or incorrect nonce validation on …

wedevs ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Web / CMS

Jul 1, 2023
Medium 4.3

CVE-2023-1844

Subscribe2 <= 10.40 - Missing Authorization

The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40. This makes it possible for author-level attackers to send email…

wedevs Subscribe2 – Form, Email Subscribers & Newsletters Web / CMS

Jun 28, 2023
Medium 4.3

CVE-2023-3407

Subscribe2 <= 10.40 - Cross-Site Request Forgery

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to sen…

wedevs Subscribe2 – Form, Email Subscribers & Newsletters Web / CMS

Jun 28, 2023
Medium 5.4

CVE-2021-36826

WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability

Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions.

wedevs WP Project Manager (WordPress plugin) Web / CMS

Apr 4, 2022
Unscored —

CVE-2021-24292

Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSS

The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all v…

wedevs Happy Addons for Elementor Happy Addons Pro for Elementor Web / CMS

May 17, 2021

wedevs

Products

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting

WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection

WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability

Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting

WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection

WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection

WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

WordPress WP Project Manager Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)

WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection

WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation

WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)

WordPress Happy Addons for Elementor Plugin <= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

WP Project Manager <= 2.4.0 - Cross-Site Request Forgery Bypass

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.6.3 - Cross-Site Request Forgery Bypass

Subscribe2 <= 10.40 - Missing Authorization

Subscribe2 <= 10.40 - Cross-Site Request Forgery

WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability

Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSS