Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 115

Export CSV
CVE-2024-10520

WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion

The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'Create_Milestone', 'Create_Task_List', 'Create_Task', and 'Delete_Task' classes in version 2.6.14. This makes it possible for unauthenticated attackers to create milestones, create task lists, create tasks, or delete tasks in any project. NOTE: Version 2.6.14 implemented a partial fix for this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Project Manager Wp Project Manager Task Team And Project Management Plugin Featuring Kanban Board And Gantt Charts
CVE-2024-12812

WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Erp
CVE-2024-12808

WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Erp
CVE-2023-2743

WP ERP < 1.12.4 - Reflected Cross-Site Scripting

The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Erp
CVE-2021-24649

WP User Frontend < 3.5.29 - Obscure Registration as Admin

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp User Frontend
CVE-2021-36826

WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability

Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Project Manager
CVE-2023-34008

WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp Erp
CVE-2023-2744

WP ERP < 1.12.4 - Admin+ SQL Injection

The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

CVSS 3.1 · 7.2 High EPSS 2.6% KEV · Not listed
Vendors
Wedevs
Products
Wp Erp
CVE-2024-34822

WordPress weMail plugin <= 1.14.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs weMail.This issue affects weMail: from n/a through 1.14.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wemail
CVE-2023-52217

WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Woocommerce Conversion Tracking
CVE-2023-41236

WordPress Happy Elementor Addons Pro Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Happy addons Happy Elementor Addons Pro plugin <= 2.8.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Happy Addons For Elementor
CVE-2023-28989

WordPress Happy Addons for Elementor Plugin <= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Happy Addons For Elementor
CVE-2021-25076

WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting

CVSS 3.1 · 8.8 High EPSS 17.3% KEV · Not listed
Vendors
Wedevs
Products
Wp User Frontend
CVE-2021-24292

Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSS

The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Happy Addons For Elementor
CVE-2024-38693

WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Wedevs
Products
Wp User Frontend