Wedevs
Vulnerability activity for Wedevs: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 14
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 90 days
- CVEs
- 22
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 365 days
- CVEs
- 24
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 4.3MediumNov 4, 2026Wedevs wePOS – Point Of Sale (POS) for WooCommerce & Dokan Auth bypass / access controlCVE-2026-121993wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and g
- 5.3MediumNov 3, 2026weDevs Dokan Auth bypass / access controlCVE-2026-119487Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.
- 5.3MediumNov 3, 2026weDevs Dokan Auth bypass / access controlCVE-2026-119485Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.
- 8.8HighOct 31, 2026Wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Sub Privilege escalationCVE-2026-120070The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the datab
- 9.8CriticalOct 31, 2026Wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Path traversal / file handlingCVE-2026-116512The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackersExploit code
- 6.1MediumOct 31, 2026Wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Sub XSSCVE-2026-103962The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'field_attr[required]' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into per
- 7.2HighOct 30, 2026Wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce XSSCVE-2026-96894The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The inbound email router's only gate is a regex match on the References header for
- 6.4MediumOct 29, 2026weDevs Happy Addons for Elementor Auth bypass / access controlCVE-2026-109891Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
- 4.3MediumOct 29, 2026weDevs WP User Frontend Auth bypass / access controlCVE-2026-52708Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
- 5.3MediumOct 29, 2026weDevs WP User Frontend Auth bypass / access controlCVE-2026-48884Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
- 4.3MediumOct 29, 2026weDevs WP ERP Auth bypass / access controlCVE-2026-25448Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10.
- 6.5MediumOct 29, 2026weDevs Happy Addons for Elementor XSSCVE-2026-116850Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
- 7.2HighOct 28, 2026weDevs Dokan DeserializationCVE-2026-115590Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
- 6.4MediumOct 10, 2026Wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Sub XSSCVE-2026-96574The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter in all versions up to, and including, 4.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenev
- 6.5MediumOct 7, 2026weDevs Happy Addons for Elementor XSSCVE-2026-104393Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.
- 7.1HighOct 6, 2026weDevs StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart XSSCVE-2026-39750Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
- 7.1HighOct 6, 2026weDevs WP User Frontend Pro XSSCVE-2026-32572Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
- 7.6HighSep 30, 2026weDevs WP ERP SQL injectionCVE-2026-96346Author SQL Injection in WP ERP <= 1.17.9 versions.
- 7.2HighSep 30, 2026weDevs WP ERP DeserializationCVE-2026-96343Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
- 6.5MediumSep 23, 2026weDevs WP User Frontend Path traversal / file handlingCVE-2026-95525Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.
- 5.3MediumSep 23, 2026weDevs WP User Frontend Auth bypass / access controlCVE-2026-95524Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
- 6.5MediumSep 23, 2026weDevs WP User Frontend Auth bypass / access controlCVE-2026-95523Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
- 6.5MediumJun 29, 2026weDevs WP User Frontend Auth bypass / access controlCVE-2026-57334Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.
- 6.5MediumApr 29, 2026weDevs WP User Frontend Auth bypass / access controlCVE-2026-42412Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1.
Top products
- WP User Frontend7 CVEs in the last year
- WP ERP3 CVEs in the last year
- User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Sub3 CVEs in the last year
- Happy Addons for Elementor3 CVEs in the last year
- Dokan3 CVEs in the last year
- WP User Frontend Pro1 CVE in the last year
- wePOS – Point Of Sale (POS) for WooCommerce & Dokan1 CVE in the last year
- StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart1 CVE in the last year
- Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker1 CVE in the last year, 1 critical
- ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.