Skip to content
Noroxi

weDevs records

52 published records for vendor wedevs.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
46.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

52 records
  • CVE-2021-25076
    40Plan

    WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

    HighCVSS 8.8Proof of conceptEPSS 17%

    wedevs · wp user frontendJan 24, 2022

  • CVE-2021-24649
    39Monitor

    WP User Frontend < 3.5.29 - Obscure Registration as Admin

    CriticalCVSS 9.8No exploitEPSS 0%

    wedevs · wp user frontendNov 21, 2022

  • CVE-2023-34383
    39Monitor

    WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection

    CriticalCVSS 9.8No exploitEPSS 0%

    wedevs · wp project managerNov 3, 2023

  • CVE-2023-40003
    39Monitor

    WordPress WP Project Manager plugin <= 2.6.7 - Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    wedevs · wp project managerDec 13, 2024

  • CVE-2023-3636
    35Monitor

    WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation

    HighCVSS 8.8No exploitEPSS 0%

    wedevs · wp project managerAug 31, 2023

  • CVE-2024-6666
    35Monitor

    WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id

    HighCVSS 8.8No exploitEPSS 0%

    wedevs · wp erpJul 11, 2024

  • CVE-2020-36745
    35Monitor

    WP Project Manager <= 2.4.0 - Cross-Site Request Forgery Bypass

    HighCVSS 8.8No exploitEPSS 0%

    wedevs · wp project managerJul 1, 2023

  • CVE-2023-28989
    35Monitor

    WordPress Happy Addons for Elementor Plugin <= 3.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    wedevs · happy addons for elementorJul 10, 2023

  • CVE-2025-32280
    35Monitor

    WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    wedevs · wp project managerApr 4, 2025

  • CVE-2024-12812
    30Monitor

    WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information

    HighCVSS 7.5No exploitEPSS 0%

    wedevs · wp erpMay 15, 2025

  • CVE-2024-12015
    30Monitor

    SQL Injection in WordPress Project Manager Plugin

    HighCVSS 7.7No exploitEPSS 0%

    wedevs · wp project managerDec 2, 2024

  • CVE-2025-47540
    30Monitor

    WordPress weMail plugin <= 1.14.13 - Sensitive Data Exposure Vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    wedevs · wemailMay 7, 2025

  • CVE-2023-2744
    29Monitor

    WP ERP < 1.12.4 - Admin+ SQL Injection

    HighCVSS 7.2Proof of conceptEPSS 2%

    wedevs · wp erpJun 27, 2023

  • CVE-2024-10174
    29Monitor

    WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthent

    HighCVSS 7.3No exploitEPSS 0%

    wedevs · wp project managerNov 13, 2024

  • CVE-2024-0952
    28Monitor

    WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id

    HighCVSS 7.2No exploitEPSS 0%

    wedevs · wp erpApr 9, 2024

  • CVE-2024-1173
    28Monitor

    WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection

    HighCVSS 7.2No exploitEPSS 0%

    wedevs · wp erpMay 2, 2024

  • CVE-2023-47682
    28Monitor

    WordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    wedevs · wp user frontendMay 17, 2024

  • CVE-2024-0913
    28Monitor

    WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection

    HighCVSS 7.2No exploitEPSS 0%

    wedevs · wp erpMar 29, 2024

  • CVE-2024-38693
    28Monitor

    WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    wedevs · wp user frontendAug 29, 2024

  • CVE-2024-0608
    26Monitor

    WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection

    MediumCVSS 6.5No exploitEPSS 0%

    wedevs · wp erpMar 29, 2024

  • CVE-2024-13752
    26Monitor

    WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

    MediumCVSS 6.5No exploitEPSS 0%

    wedevs · wp project managerFeb 15, 2025

  • CVE-2024-12195
    26Monitor

    WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection

    MediumCVSS 6.5No exploitEPSS 0%

    wedevs · wp project managerJan 4, 2025

  • CVE-2024-13500
    26Monitor

    WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter

    MediumCVSS 6.5No exploitEPSS 0%

    wedevs · wp project managerFeb 15, 2025

  • CVE-2024-10548
    26Monitor

    WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API

    MediumCVSS 6.5No exploitEPSS 0%

    wedevs · wp project managerDec 18, 2024

  • CVE-2023-51676
    26Monitor

    WordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF)

    MediumCVSS 6.5No exploitEPSS 0%

    wedevs · happy addons for elementorDec 29, 2023