Wedevs vulnerabilities
128 vulnerabilities
Known vulnerabilities in Wedevs products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 32 products.
Products
25 of 32- Wp Erp23 vulnerabilities
- Wp Project Manager21 vulnerabilities
- Wp User Frontend15 vulnerabilities
- Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker11 vulnerabilities
- Happy Addons For Elementor10 vulnerabilities
- Dokan Pro7 vulnerabilities
- Wemail4 vulnerabilities
- Storegrowth – Upsell, Bogo, Quick View, Direct Checkout & Side Cart For Woocommerce3 vulnerabilities
- Subscribe2 – Form, Email Subscribers & Newsletters3 vulnerabilities
- Woocommerce Conversion Tracking3 vulnerabilities
- WP User Frontend Pro3 vulnerabilities
- Appsero Helper2 vulnerabilities
- Dokan – Best Woocommerce Multivendor Marketplace Solution – Build Your Own Amazon, Ebay, Etsy2 vulnerabilities
- Recaptcha Integration For Wordpress2 vulnerabilities
- Subscribe22 vulnerabilities
- Wedocs2 vulnerabilities
- Happy Addons For Elementor Pro1 vulnerabilities
- Happy Addons Pro For Elementor1 vulnerabilities
- Recaptcha Integration1 vulnerabilities
- User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction With Frontend Post Submission1 vulnerabilities
- WP ERP | Complete HR Solution With Recruitment & Job Listings | Woocommerce CRM & Accounting1 vulnerabilities
- WP ERP Pro1 vulnerabilities
- WP Project Manager – Task, Team, And Project Management Plugin Featuring Kanban Board And Gantt Charts1 vulnerabilities
- WP Project Manager Pro1 vulnerabilities
- WP Project Manager (Wordpress Plugin)1 vulnerabilities
CVE-2021-36826wedevswp_project_manager+2
EPSS score0.62%
Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions.CVE-2021-25076unknownwp user frontend – membership, profile, registration & post submission plugin for wordpress+2EPSS score17.12%
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site ScriptingCVE-2021-24292wedevshappy_addons_for_elementor+3EPSS score0.64%
The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.CVE-2021-24649unknownwp user frontend+2EPSS score0.69%
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as adminCVE-2025-63008wedevswp_erp+1EPSS score0.30%
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.16.7.CVE-2025-2541wedevsproject manager – ai powered project management, task management, kanban board & time tracker+2EPSS score0.31%
The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.CVE-2025-13921wedevswedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbot+1EPSS score0.29%
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data due to a missing capability check on the 'wedocs_user_documentation_handling_capabilities' function in all versions up to, and including, 2.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit any documentation post. The vulnerability was partially patched in version 2.1.16.CVE-2025-68040wedevswp_project_manager+1EPSS score0.26%
Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 3.0.1.CVE-2025-47540wedevswemail+1EPSS score0.41%
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs weMail wemail allows Retrieve Embedded Sensitive Data.This issue affects weMail: from n/a through <= 1.14.13.CVE-2025-14574wedevswedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbot+1EPSS score0.35%
The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/settings` REST API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including third party services API keys.CVE-2025-14339wedevswemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerce+1EPSS score0.30%
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the `Forms::permission()` callback only validating the `X-WP-Nonce` header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the `weMail` JavaScript object on pages with weMail forms, any unauthenticated user can permanently delete all weMail forms by extracting the nonce from the page source and sending a DELETE request to the forms endpoint.CVE-2025-14348wedevswemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerce+1EPSS score0.32%
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the `x-wemail-user` HTTP header to identify users without verifying the request originates from an authenticated WordPress session. This makes it possible for unauthenticated attackers who know or can guess an admin email (easily enumerable via `/wp-json/wp/v2/users`) to impersonate that user and access the CSV subscriber endpoints, potentially exfiltrating subscriber PII (emails, names, phone numbers) from imported CSV files.CVE-2025-14047wedevsuser frontend: ai powered frontend posting, user directory, profile, membership & user registration+1EPSS score0.90%
The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'Frontend_Form_Ajax::submit_post' function in all versions up to, and including, 4.2.4. This makes it possible for unauthenticated attackers to delete attachment.CVE-2025-39377wedevsappsero helper+1EPSS score0.34%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper appsero-helper allows SQL Injection.This issue affects Appsero Helper: from n/a through <= 1.3.4.CVE-2025-58672wedevswp_user_frontend+1EPSS score0.27%
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.1.12.CVE-2025-58673wedevswp_user_frontend+1EPSS score0.24%
Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP User Frontend: from n/a through <= 4.1.12.CVE-2025-58269wedevswp_project_manager+1EPSS score0.29%
Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.CVE-2025-67546wedevswp_erp+1EPSS score0.25%
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs WP ERP erp allows Retrieve Embedded Sensitive Data.This issue affects WP ERP: from n/a through <= 1.16.6.CVE-2025-5931wedevsdokan pro+1EPSS score0.45%
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff password reset. This makes it possible for authenticated attackers, with vendor-level access and above, to elevate their privilege to the level of a staff member and then change arbitrary user passwords, including those of administrators in order to gain access to their accounts. By default, the plugin allows customers to become vendors.CVE-2025-22649wedevswp_project_manager+1EPSS score0.27%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager wedevs-project-manager allows Stored XSS.This issue affects WP Project Manager: from n/a through <= 2.6.22.