CVE-2026-81283WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 09/02/2026 Severity High CVE-2026-18080ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Published 08/26/2026 Severity Critical CVE-2026-78470WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection Exploitation status Not known exploited Fix Affected product W WP Project Manager Pro Published 08/25/2026 Severity Medium CVE-2026-78262WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product W WP Project Manager Published 08/24/2026 Severity Critical CVE-2026-73393WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product S Subscribe2 Published 08/18/2026 Severity High CVE-2026-66466WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart Published 08/13/2026 Severity High CVE-2026-11421ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Published 08/05/2026 Severity Medium CVE-2026-13110StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action Exploitation status Not known exploited Fix Affected product S StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce Published 07/28/2026 Severity Medium CVE-2026-15411StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action Exploitation status Not known exploited Fix Affected product S StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce Published 07/28/2026 Severity Medium CVE-2026-13440StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter Exploitation status Not known exploited Fix Affected product S StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce Published 07/28/2026 Severity High CVE-2026-59522WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP ERP Published 07/23/2026 Severity Medium CVE-2026-15349ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Published 07/17/2026 Severity Medium CVE-2026-12418User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter Exploitation status Not known exploited Fix Affected product U User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration Published 07/09/2026 Severity Medium CVE-2026-13011ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Published 07/09/2026 Severity Medium CVE-2026-12406User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter Exploitation status Not known exploited Fix Affected product U User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration Published 07/09/2026 Severity Medium CVE-2026-5459User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite Exploitation status Not known exploited Fix Affected product U User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration Published 07/08/2026 Severity Medium CVE-2026-12731weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes Exploitation status Not known exploited Fix Affected product W weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot Published 07/03/2026 Severity Medium CVE-2026-12729weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action Exploitation status Not known exploited Fix Affected product W weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot Published 07/03/2026 Severity Medium CVE-2026-12734weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute Exploitation status Not known exploited Fix Affected product W weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot Published 07/03/2026 Severity Medium CVE-2026-12224Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint Exploitation status Not known exploited Fix Affected product D Dokan Pro Published 07/01/2026 Severity High CVE-2026-57334WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 06/29/2026 Severity Medium CVE-2026-57322WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W weMail Published 06/26/2026 Severity High CVE-2026-12077Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters Exploitation status Not known exploited Fix Affected product D Dokan Pro Published 06/25/2026 Severity High CVE-2026-12079Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter Exploitation status Not known exploited Fix Affected product D Dokan Pro Published 06/25/2026 Severity Medium CVE-2022-47150WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Conversion Tracking Published 06/11/2026 Severity Medium CVE-2026-4058User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation Exploitation status Not known exploited Fix Affected product U User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Published 06/09/2026 Severity Medium CVE-2026-4834WP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter Exploitation status Not known exploited Fix Affected product W WP ERP Pro Published 05/22/2026 Severity High CVE-2026-5127User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection Exploitation status Not known exploited Fix Affected product U User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Published 05/08/2026 Severity High CVE-2026-25468WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product H Happy Addons for Elementor Published 05/07/2026 Severity Medium CVE-2026-42412WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 04/29/2026 Severity Medium CVE-2026-39520WordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W weDocs Published 04/08/2026 Severity Medium CVE-2026-32485WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 03/25/2026 Severity High CVE-2026-24364WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 03/25/2026 Severity Medium CVE-2026-2233User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter Exploitation status Not known exploited Fix Affected product U User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Published 03/15/2026 Severity Medium CVE-2026-31917WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product W WP ERP Published 03/13/2026 Severity High CVE-2026-1565User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Authenticated (Author+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product U User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Published 02/26/2026 Severity High CVE-2025-14339weMail <= 2.0.7 - Missing Authorization to Unauthenticated Form Deletion Exploitation status Not known exploited Fix Affected product W weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce Published 02/21/2026 Severity Medium CVE-2026-24944WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Subscribe2 Published 02/20/2026 Severity Medium CVE-2025-13921weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update Exploitation status Not known exploited Fix Affected product W weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot Published 01/23/2026 Severity Medium CVE-2025-14348weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure Exploitation status Not known exploited Fix Affected product W weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce Published 01/20/2026 Severity Medium CVE-2025-14574weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product W weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot Published 01/09/2026 Severity Medium CVE-2025-14047WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion Exploitation status Not known exploited Fix Affected product U User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Published 01/02/2026 Severity Medium CVE-2025-68040WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product W WP Project Manager Published 12/29/2025 Severity Medium CVE-2025-67546WordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product W WP ERP Published 12/18/2025 Severity Medium CVE-2025-12809dokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product D Dokan Pro Published 12/16/2025 Severity Medium CVE-2025-63008WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP ERP Published 12/09/2025 Severity Medium CVE-2025-12505weDocs <= 2.1.14 - Missing Authorization to Settings Update Exploitation status Not known exploited Fix Affected product W weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot Published 12/06/2025 Severity Medium CVE-2025-8994WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator' Exploitation status Not known exploited Fix Affected product P Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Published 11/15/2025 Severity Medium CVE-2025-58269WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability Exploitation status Not known exploited Fix Affected product W WP Project Manager Published 09/22/2025 Severity Medium CVE-2025-58672WordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control Vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 09/22/2025 Severity Medium CVE-2025-58673WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection Vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 09/22/2025 Severity Medium CVE-2025-5931Dokan Pro <= 4.0.5 - Authenticated (Vendor+) Privilege Escalation Exploitation status Not known exploited Fix Affected product D Dokan Pro Published 08/26/2025 Severity High CVE-2025-3055WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion Exploitation status Not known exploited Fix Affected product W WP User Frontend Pro Published 06/05/2025 Severity High CVE-2025-3054WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product W WP User Frontend Pro Published 06/05/2025 Severity High CVE-2024-12812WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information Exploitation status Public exploit Fix Affected product W WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Published 05/15/2025 Severity High CVE-2024-12808WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product W WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Published 05/15/2025 Severity Medium CVE-2025-47540WordPress weMail plugin <= 1.14.13 - Sensitive Data Exposure Vulnerability Exploitation status Not known exploited Fix Affected product W weMail Published 05/07/2025 Severity Medium CVE-2025-39377WordPress Appsero Helper plugin <= 1.3.4 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product A Appsero Helper Published 04/24/2025 Severity High CVE-2025-2541WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product P Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Published 04/11/2025 Severity Medium CVE-2025-3100WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product P Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Published 04/09/2025 Severity Medium CVE-2025-32280WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability Exploitation status Not known exploited Fix Affected product W WP Project Manager Published 04/04/2025 Severity Medium CVE-2025-22649WordPress WP Project Manager plugin <= 2.6.22 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W WP Project Manager Published 03/27/2025 Severity Medium CVE-2025-30896WordPress WP ERP plugin <= 1.13.4 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP ERP Published 03/27/2025 Severity Medium CVE-2024-13436Appsero Helper <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product A Appsero Helper Published 03/11/2025 Severity Medium CVE-2024-11582Subscribe2 – Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter Exploitation status Not known exploited Fix Affected product S Subscribe2 – Form, Email Subscribers & Newsletters Published 02/19/2025 Severity High CVE-2024-13500WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter Exploitation status Not known exploited Fix Affected product P Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Published 02/15/2025 Severity Medium CVE-2024-13752WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update Exploitation status Not known exploited Fix Affected product P Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Published 02/15/2025 Severity Medium CVE-2024-12852Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product H Happy Addons for Elementor Published 01/08/2025 Severity Medium CVE-2024-12195WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection Exploitation status Not known exploited Fix Affected product P Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Published 01/04/2025 Severity Medium CVE-2023-45765WordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP ERP Published 01/02/2025 Severity Medium CVE-2023-45002WordPress WP User Frontend plugin <= 3.6.8 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 01/02/2025 Severity Medium CVE-2024-10548WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API Exploitation status Not known exploited Fix Affected product P Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Published 12/19/2024 Severity Medium CVE-2023-40003WordPress WP Project Manager plugin <= 2.6.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP Project Manager Published 12/13/2024 Severity Medium CVE-2024-12015SQL Injection in WordPress Project Manager Plugin Exploitation status Public exploit Fix Not confirmed Affected product W WP Project Manager Published 12/02/2024 Severity High CVE-2024-10520WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion Exploitation status Not known exploited Fix Affected product P Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Published 11/20/2024 Severity Medium CVE-2024-10174WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass Exploitation status Not known exploited Fix Affected product P Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Published 11/13/2024 Severity High CVE-2024-8739ReCaptcha Integration for WordPress <= 1.2.5 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R ReCaptcha Integration for WordPress Published 11/02/2024 Severity Medium CVE-2024-47640WordPress WP ERP plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W WP ERP Published 10/29/2024 Severity High CVE-2024-8801Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product H Happy Addons for Elementor Published 09/24/2024 Severity Medium CVE-2024-38693WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 08/29/2024 Severity High CVE-2024-43238WordPress weMail plugin <= 1.14.5 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W weMail Published 08/18/2024 Severity High CVE-2024-37946WordPress ReCaptcha Integration for WordPress plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product R ReCaptcha Integration for WordPress Published 07/20/2024 Severity Medium CVE-2024-6666WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Published 07/11/2024 Severity High CVE-2024-5790Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget Exploitation status Not known exploited Fix Affected product H Happy Addons for Elementor Published 06/29/2024 Severity Medium CVE-2024-3922Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection Exploitation status Not known exploited Fix Affected product D Dokan Pro Published 06/13/2024 Severity Critical CVE-2024-34822WordPress weMail plugin <= 1.14.2 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W weMail Published 06/11/2024 Severity Medium CVE-2024-34442WordPress weDocs plugin <= 2.1.4 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W weDocs Published 06/11/2024 Severity Medium CVE-2023-52217WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Conversion Tracking Published 06/11/2024 Severity Medium CVE-2023-47682WordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product W WP User Frontend Published 05/17/2024 Severity High CVE-2024-1173WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Published 05/02/2024 Severity High CVE-2024-0952WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Published 04/09/2024 Severity High CVE-2024-0956WP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL Injection Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Published 03/29/2024 Severity Medium CVE-2024-0609WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Published 03/29/2024 Severity High CVE-2024-0608WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Published 03/29/2024 Severity Medium CVE-2024-0913WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection Exploitation status Not known exploited Fix Affected product E ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Published 03/29/2024 Severity High CVE-2024-24711WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Conversion Tracking Published 03/26/2024 Severity Medium CVE-2022-3194Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting Exploitation status Public exploit Fix Affected product D Dokan Published 01/16/2024 Severity Medium CVE-2023-6632Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product H Happy Addons for Elementor Pro Published 01/11/2024 Severity Medium CVE-2024-21747WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection Exploitation status Not known exploited Fix Affected product W WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Published 01/08/2024 Severity High CVE-2023-51676WordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Server Side Request Forgery (SSRF) Exploitation status Not confirmed Fix Affected product H Happy Addons for Elementor Published 12/29/2023 Severity Medium 
