CVE-2024-10174

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'AbstractPermission' class due to missing validation on the 'useri...

WordPress WP Project Manager Plugin <= 2.6.13 is vulnerable to Insecure Direct Object References (IDOR)

Software WP Project Manager Type Plugin Vulnerable versions = 2.6.13 Fixed in 2.6.14 OWASP Top 10 A4: Insecure Design Classification Insecure Direct Object References IDOR CVE CVE-2024-10174 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 6aaed61c0d51 Credits stealthcopt...

CVE-2023-49860

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project...

CVE-2023-49860

CVE-2023-49860 affects the WordPress plugin WP Project Manager – Task, team, and project management plugin (weDevs) up to version 2.6.7 . The vulnerability is an improper neutralization of input during web page generation, resulting in a stored Cross-Site Scripting (XSS) condition. Public referen...

WP Project Manager < 2.6.9 - Subscriber+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected...

CVE-2023-34383

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This issue affects WP Project Manager: from n/a through 2.6.0...

CVE-2023-34383

CVE-2023-34383 affects the WordPress plugin WP Project Manager (weDevs) up to version 2.6.0. It is a SQL Injection vulnerability caused by improper neutralization of input in SQL commands, leading to unauthorized data access or manipulation when exploited by authenticated users (Subscriber+). Pub...

CVE-2023-3636

The CVE-2023-3636 entry concerns the WP Project Manager WordPress plugin (versions

WordPress WP Project Manager 2.6.4 Privilege Escalation

Description: WP Project Manager = 2.6.4 – Arbitrary Usermeta Update to Authenticated Subscriber+ Privilege Escalation Affected Plugin: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts Plugin Slug: wedevs-project-manager Affected Versions: =...

WP Project Manager < 2.6.5 - Subscriber+ Privilege Escalation

Description The plugin does not have authorisation and does not properly check for the user metadata to be updated via the saveusersmapname function, allowing any authenticated users, such as subscriber to update their role and gain administrator privileges...

weDevs Addresses Privilege Escalation Vulnerability in WP Project Manager WordPress Plugin

On July 9, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a Privilege Escalation vulnerability in weDevs’s WP Project Manager plugin, which is actively installed on more than 10,000 WordPress websites. This vulnerability makes it possible...

CVE-2020-36745

The CVE concerns the WP Project Manager WordPress plugin, affected versions up to and including 2.4.0. The root cause is missing or incorrect nonce validation in the do_updates() function, facilitating Cross-Site Request Forgery. This allows unauthenticated attackers to trigger updates by deliver...

PT-2023-11885 · WordPress · Wp Project Manager

Name of the Vulnerable Software and Affected Versions: WP Project Manager plugin for WordPress versions up to, and including, 2.4.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the do updates function. This allows unauthenticated...

WordPress weDevs WP Project Manager plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress weDevs WP Project Manager plugin has a...

CVE-2021-36826

CVE-2021-36826 is an authenticated, stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin weDevs WP Project Manager (versions 2.4.13 (Patchstack/PT-2022-10565 indicate 2.4.14 as a fixed point). No in-the-wild exploit details are provided in the documents. Monitor for updates fr...