Wedevs develops a focused but widely deployed portfolio of WordPress plugins and extensions, spanning project management, ERP functionality, form building, and email marketing tools that extend WordPress's native capabilities. The vendor's vulnerability footprint concentrates on application-layer input handling and authorization defects, with cross-site scripting, SQL injection, missing authorization, and cross-site request forgery forming the durable signal across products such as WP ERP, WP Project Manager, Happy Addons for Elementor, WeMail, and WP User Frontend. These weakness classes are characteristic of web application and plugin development, where user-supplied input and permission boundaries demand careful validation and enforcement. A meaningful share of the vendor's disclosures reach critical severity, reflecting the direct exposure of WordPress sites and their user bases to plugin flaws. Defenders should prioritize patching Wedevs plugins on publicly accessible WordPress instances and audit permission settings for multiuser deployments; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wedevs over time
Signals from CVEs in this vendor scope (64 CVEs).
64 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-25076HIGH The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an | Jan 24, 2022 | 8.8 | 48 | NO | YES |
CVE-2026-57322HIGH Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions. | Jun 26, 2026 | 7.1 | 32 | NO | NO |
CVE-2026-57334MEDIUM Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions. | Jun 29, 2026 | 6.5 | 31 | NO | NO |
CVE-2021-24649CRITICAL The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created wi | Nov 21, 2022 | 9.8 | 31 | NO | NO |
CVE-2026-59522MEDIUM Subscriber Broken Access Control in WP ERP <= 1.17.5 versions. | Jul 23, 2026 | 6.5 | 27 | NO | NO |
CVE-2026-42412MEDIUM Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects WP User Frontend: from n | Apr 29, 2026 | 6.5 | 27 | NO | NO |
CVE-2026-31917HIGH Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a thr | Mar 13, 2026 | 8.5 | 27 | NO | NO |
CVE-2023-40003CRITICAL Missing Authorization vulnerability in weDevs WP Project Manager wedevs-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects W | Dec 13, 2024 | 9.8 | 25 | NO | NO |
CVE-2024-6666HIGH The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and including, 1.13.0 due to insufficient escaping | Jul 11, 2024 | 8.8 | 25 | NO | NO |
CVE-2020-36745HIGH The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due to missing or incorrect nonce validatio | Jul 1, 2023 | 8.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (64 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wedevs.
Media articles that mention a CVE ID that affects a product developed by Wedevs — matched by CVE ID, not by vendor name.