Read the docs

weDevs

Records142All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high49CVSS 7.0–8.9

Exploited now

weDevs records in CISA KEV

No weDevs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp Erp 16 records HIGH Wp Project Manager 16 records MEDIUM Happy Addons For Elementor 8 records LOW Wemail 3 records LOW Wp User Frontend 3 records HIGH Recaptcha Integration 1 record LOW Woocommerce Conversion Tracking 1 record LOW

Records

3 records in Wp User Frontend · all components

TI-2021-06932 CVE-2021-24649 · GHSA-f4mf-54pp-jfrw

WP User Frontend < 3.5.29 - Obscure Registration as Admin

Priority HIGH 82

The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00706 Published 2022-11-21 Fixed in 3.5.29
TI-2021-07354 CVE-2021-25076 · GHSA-gx4g-7h78-x658

WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

Priority MEDIUM 55

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.17255 Published 2022-01-24 Fixed in 3.5.26 CWE-89
TI-2024-25927 CVE-2024-38693 · GHSA-hw2c-64gc-7jv5

WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability

Priority LOW 34

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00438 Published 2024-08-29 No fix listed CWE-89
Open these records in search →