Skip to content
Noroxi

WP ERP

erp · plugin

Known security vulnerabilities for WP ERP. Find out in seconds which version runs on your site with WP Lens.

23 known vulnerabilities

1 critical · 1 with public exploit code · latest Sep 30, 2026

Vulnerabilities

  • CVE-2026-18080

    ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment

    Critical 9.8

  • CVE-2024-6666

    WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id

    High 8.8

  • CVE-2026-31917

    WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability

    High 8.5

  • CVE-2026-96346

    WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability

    High 7.6

  • CVE-2026-96343

    WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

    High 7.2

  • CVE-2024-1173

    WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection

    High 7.2

  • CVE-2024-0952

    WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id

    High 7.2

  • CVE-2024-0913

    WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection

    High 7.2

  • CVE-2026-11421

    ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter

    Medium 6.5

  • CVE-2026-59522

    WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability

    Medium 6.5

  • CVE-2026-13011

    ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parame

    Medium 6.5

  • CVE-2025-67546

    WordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerability

    Medium 6.5

  • CVE-2024-0608

    WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection

    Medium 6.5

  • CVE-2024-47640

    WordPress WP ERP plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2024-0609

    WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting

    Medium 6.1

  • CVE-2023-34008

    WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2025-30896

    WordPress WP ERP plugin <= 1.13.4 - Broken Access Control vulnerability

    Medium 5.4

  • CVE-2025-63008

    WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2024-0956

    WP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL Injection

    Medium 4.9

  • CVE-2024-21747

    WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection

    Medium 4.9

  • CVE-2026-15349

    ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creat

    Medium 4.3

  • CVE-2023-45765

    WordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2020-36735→ 1.6.4

    WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.6.3 - Cross-Site Request Forgery Bypass

    Medium 4.3

← Back to directory