Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 115

Export CSV
CVE-2026-4058

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_subscription_cancel() function in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel any user's subscription pack, including administrators.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
User Frontend: Ai Powered Frontend Posting, User Directory, Profile, Membership & User Registration Wordpress
CVE-2026-4834

WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter

The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp Erp Wordpress
CVE-2026-5127

User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize() when displaying post content. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP objects, which can be leveraged to execute arbitrary code, delete arbitrary files, or perform other malicious actions if a POP chain is present on the target system.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
User Frontend: Ai Powered Frontend Posting, User Directory, Profile, Membership & User Registration Wordpress
CVE-2026-25468

WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs Happy Addons for Elementor allows Retrieve Embedded Sensitive Data. This issue affects Happy Addons for Elementor: from n/a through 3.20.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Happy Addons For Elementor Wordpress
CVE-2026-42412

WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp User Frontend Wordpress
CVE-2026-39520

WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through <= 2.1.18.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wedocs Wordpress
CVE-2026-32485

WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp User Frontend Wordpress
CVE-2023-40003

WordPress WP Project Manager plugin <= 2.6.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP Project Manager wedevs-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Project Manager: from n/a through <= 2.6.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Project Manager
CVE-2023-45002

WordPress WP User Frontend plugin <= 3.6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp User Frontend Wordpress
CVE-2023-34383

WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Project Manager
CVE-2024-24711

WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Woocommerce Conversion Tracking
CVE-2024-21747

WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: from n/a through 1.12.8.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Erp
CVE-2023-51676

WordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Happy Addons For Elementor
CVE-2023-49860

WordPress WP Project Manager Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: from n/a through 2.6.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Project Manager
CVE-2026-24364

WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp User Frontend Wordpress
CVE-2025-63008

WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.16.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp Erp Wordpress
CVE-2025-58269

WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability

Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp Project Manager Wordpress
CVE-2025-47540

WordPress weMail plugin <= 1.14.13 - Sensitive Data Exposure Vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs weMail wemail allows Retrieve Embedded Sensitive Data.This issue affects weMail: from n/a through <= 1.14.13.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wemail
CVE-2025-32280

WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager wedevs-project-manager allows Cross Site Request Forgery.This issue affects WP Project Manager: from n/a through < 2.6.25.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Project Manager
CVE-2025-22649

WordPress WP Project Manager plugin <= 2.6.22 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager wedevs-project-manager allows Stored XSS.This issue affects WP Project Manager: from n/a through <= 2.6.22.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Project Manager