Wedevs vulnerabilities, page 5
128 vulnerabilities
Known vulnerabilities in Wedevs products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 32 products.
MediumCVE-2026-57334wedevs · wp_user_frontend +1 moreWordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.EPSS0.33%HighCVE-2026-57322wedevs · wemail +1 moreWordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2.EPSS0.25%HighCVE-2026-5127wedevs · user frontend: ai powered frontend posting, user directory, profile, membership & user registration +1 moreUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object InjectionThe User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize() when displaying post content. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP objects, which can be leveraged to execute arbitrary code, delete arbitrary files, or perform other malicious actions if a POP chain is present on the target system.EPSS1.33%MediumCVE-2026-5459wedevs · user frontend: ai powered frontend posting, user directory, profile builder, membership & user registration +1 moreUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription OverwriteThe User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.EPSS0.31%MediumCVE-2026-104393wedevs · happy_addons_for_elementor +1 moreWordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.EPSS0.13%MediumCVE-2026-24364wedevs · wp_user_frontend +1 moreWordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerabilityMissing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.5.EPSS0.32%MediumCVE-2026-24944wedevs · subscribe2 +1 moreWordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerabilityMissing Authorization vulnerability in weDevs Subscribe2 subscribe2 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe2: from n/a through <= 10.44.EPSS0.20%HighCVE-2026-95525wedevs · wp_user_frontend +1 moreWordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerabilitySubscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.EPSS0.47%MediumCVE-2026-95524wedevs · wp_user_frontend +1 moreWordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerabilityUnauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.EPSS0.25%MediumCVE-2026-95523wedevs · wp_user_frontend +1 moreWordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerabilitySubscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.EPSS0.34%HighCVE-2026-81283wedevs · wp_user_frontend +1 moreWordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerabilitySubscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.EPSS0.52%MediumCVE-2026-15411wedevs · storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerce +1 moreStoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX ActionThe StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary attacker-controlled data. The 'ajd_protected' nonce used as the sole gate is exposed to unauthenticated visitors on every frontend page through the BoGo module's wp_localize_script call, rendering it ineffective as an authorization barrier.EPSS0.45%MediumCVE-2026-15349wedevs · erp: complete hr, accounting & crm suite built for woocommerce +1 moreERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX HandlerThe ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary company locations in the ERP database.EPSS0.47%HighCVE-2026-96343wedevs · wp_erp +1 moreWordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerabilityCustom role PHP Object Injection in WP ERP <= 1.17.9 versions.EPSS0.37%MediumCVE-2026-96574wedevs · user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission +1 moreUser Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' ParameterThe User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass technique involves appending a valid gateway keyword such as 'bank' to the HTML payload, causing sanitize_text_field() to yield only the keyword for routing purposes while the full malicious raw value is stored and later rendered unescaped.EPSS0.22%HighCVE-2026-96346wedevs · wp_erp +1 moreWordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerabilityAuthor SQL Injection in WP ERP <= 1.17.9 versions.EPSS0.28%HighCVE-2026-32485wedevs · wp_user_frontend +1 moreWordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerabilityMissing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.8.EPSS0.40%HighCVE-2026-32572wedevs · wp user frontend pro +1 moreWordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.EPSS0.24%MediumCVE-2026-78470wedevs · wp project manager pro +1 moreWP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL InjectionThe WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.EPSS0.38%CriticalCVE-2026-78262wedevs · wp_project_manager +1 moreWordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerabilityUnauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.EPSS0.56%