Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

weDevs — Vulnerabilities & Security Advisories 76

Browse all 76 CVE security advisories affecting weDevs. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by weDevs:Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time TrackerERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM SupportWP ERPWP Project ManagerWP User FrontendSubscribe2 – Form, Email Subscribers & NewslettersDokan ProUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User RegistrationweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI ChatbotweMailWP User Frontend ProAppsero HelperReCaptcha Integration for WordPressweDocsWooCommerce Conversion TrackingweMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerceDokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, EtsyHappy Addons for ElementorSubscribe2Happy Addons for Elementor ProWP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & AccountingWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt chartsWP Project Manager (WordPress plugin)
CVE IDTitleCVSSSeverityPublished
CVE-2026-39520 WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerability — weDocsCWE-862 7.1AIHighAI2026-04-08
CVE-2026-32485 WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability — WP User FrontendCWE-862 8.1 -2026-03-25
CVE-2026-24364 WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability — WP User FrontendCWE-862 6.5 Medium2026-03-25
CVE-2026-2233 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter — User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User RegistrationCWE-862 5.3 Medium2026-03-15
CVE-2026-31917 WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability — WP ERPCWE-89 9.8 -2026-03-13
CVE-2026-1565 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload — User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User RegistrationCWE-434 8.8 High2026-02-26
CVE-2025-14339 weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion — weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerceCWE-862 6.5 Medium2026-02-21
CVE-2026-24944 WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerability — Subscribe2CWE-862 9.1AICriticalAI2026-02-20
CVE-2025-13921 weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update — weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI ChatbotCWE-862 4.3 Medium2026-01-23
CVE-2025-14348 weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure — weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerceCWE-285 5.3 Medium2026-01-20
CVE-2025-14574 weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure — weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI ChatbotCWE-200 5.3 Medium2026-01-09
CVE-2025-14047 WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion — User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User RegistrationCWE-862 5.3 Medium2026-01-02
CVE-2025-68040 WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability — WP Project ManagerCWE-201 6.5 Medium2025-12-29
CVE-2025-67546 WordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerability — WP ERPCWE-497 7.5AIHighAI2025-12-18
CVE-2025-12809 dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure — Dokan ProCWE-862 5.3 Medium2025-12-16
CVE-2025-63008 WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability — WP ERPCWE-862 5.3 Medium2025-12-09
CVE-2025-12505 weDocs <= 2.1.14 - Missing Authorization to Settings Update — weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI ChatbotCWE-285 5.4 Medium2025-12-06
CVE-2025-8994 WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator' — Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time TrackerCWE-89 6.5 Medium2025-11-15
CVE-2025-58269 WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability — WP Project ManagerCWE-798 5.3 Medium2025-09-22
CVE-2025-58672 WordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control Vulnerability — WP User FrontendCWE-862 5.4 Medium2025-09-22
CVE-2025-58673 WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection Vulnerability — WP User FrontendCWE-94 5.4 Medium2025-09-22
CVE-2025-5931 Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation — Dokan ProCWE-269 8.8 High2025-08-26
CVE-2025-3055 WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion — WP User Frontend ProCWE-22 8.1 High2025-06-05
CVE-2025-3054 WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload — WP User Frontend ProCWE-434 8.8 High2025-06-05
CVE-2025-47540 WordPress weMail plugin <= 1.14.13 - Sensitive Data Exposure Vulnerability — weMailCWE-497 5.3 Medium2025-05-07
CVE-2025-39377 WordPress Appsero Helper plugin <= 1.3.4 - SQL Injection vulnerability — Appsero HelperCWE-89 8.5 High2025-04-24
CVE-2025-2541 WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload — Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time TrackerCWE-79 6.4 Medium2025-04-11
CVE-2025-3100 WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload — Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time TrackerCWE-79 6.4 Medium2025-04-09
CVE-2025-32280 WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability — WP Project ManagerCWE-352 4.3 Medium2025-04-04
CVE-2025-22649 WordPress WP Project Manager plugin <= 2.6.22 - Cross Site Scripting (XSS) vulnerability — WP Project ManagerCWE-79 5.9 Medium2025-03-27

This page lists every published CVE security advisory associated with weDevs. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.