wedevs vulnerabilities
130 published CVEs name wedevs among the affected products.
- Published CVEs
- 130
- Last 12 months
- 72
- Critical
- 4
- Known exploited
- 0
Critical 4High 41Medium 85Low 0Not scored 0
CVEs per yearBy the year they were published
- 20211
- 20221
- 202311
- 202425
- 202526
- 202666
Newest CVEs
- CVE-2026-121993
wePOS before 2.0.3 Missing Authorization via payment/process Endpoint
wedevs · wePOS – Point Of Sale (POS) for WooCommerce & Dokan
Medium5.3 - CVE-2026-119485
WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability
weDevs · Dokan
Medium5.3 - CVE-2026-119487
WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability
weDevs · Dokan
Medium5.3 - CVE-2026-120070
User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
wedevs · User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
High8.8 - CVE-2026-116512
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
wedevs · Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
Critical9.8 - CVE-2026-103962
User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter
wedevs · User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
Medium6.1 - CVE-2026-96894
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
wedevs · ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
High7.2 - CVE-2026-109891
WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability
weDevs · Happy Addons for Elementor
Medium6.4 - CVE-2026-25448
WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability
weDevs · WP ERP
Medium4.3 - CVE-2026-116850
WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability
weDevs · Happy Addons for Elementor
Medium6.5
Products with the most CVEs
- WP User Frontend15
- Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker12
- WP ERP11
- WP Project Manager9
- ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support8
- Dokan Pro7
- Happy Addons for Elementor6
- weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot6
- ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce5
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration5
Most common weaknesses
- CWE-862 Missing authorization40
- CWE-79 Cross-site scripting (XSS)27
- CWE-89 SQL injection24
- CWE-352 Cross-site request forgery (CSRF)7
- CWE-502 Deserialization of untrusted data6
- CWE-269 Improper privilege management5
- CWE-434 Unrestricted file upload4
- CWE-497 3
- CWE-639 Authorization bypass through a user-controlled key (IDOR)3
- CWE-200 Exposure of sensitive information2