CVE-2024-0913

CVE-2024-0913 affects WP ERP for WordPress (WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting) up to version 1.12.9. The issue is a time-based SQL Injection in the erp/v1/accounting/v1/transactions/sales REST endpoint caused by insufficient escaping of u...

CVE-2024-0609

CVE-2024-0609 is a Stored Cross-Site Scripting vulnerability in the WP ERP plugin for WordPress (WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting). Public records describe the issue as: unauthenticated (WordPress users) can inject scripts via the api_ke...

CVE-2024-0608

CVE-2024-0608 affects the WP ERP plugin for WordPress; union-based SQL injection via the 'email' parameter in all versions up to 1.13.1 due to insufficient escaping and lack of proper query preparation. Authenticated attackers with subscriber+ access can append SQL to extract data. Current status...

CVE-2023-45765

CVE-2023-45765 concerns weDevs WP ERP plugin versions

CVE-2024-0952

CVE-2024-0952 applies to the WP ERP plugin (WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting) for WordPress. A time-based SQL injection exists in the id parameter across all versions up to 1.12.9 due to insufficient escaping and lack of proper query pre...

CVE-2024-0956

CVE-2024-0956 affects the WP ERP plugin for WordPress, with a time-based SQL Injection via the erp/v1/accounting/v1/vendors/1/products/ REST route. Exploitation requires authenticated admin/accounting privileges; the issue impacts WP ERP versions listed (initial doc says up to 1.13.0; Red Hat ent...

CVE-2024-6666

WP ERP for WordPress is vulnerable to SQL Injection via vendor_id in versions up to 1.13.0. The flaw stems from insufficient escaping and query preparation, enabling authenticated attackers with Accounting Manager+ permissions (erp_ac_view_sales_summary) to inject additional SQL into existing que...

CVE-2024-1173

CVE-2024-1173 affects the WP ERP plugin for WordPress, exposing a time-based SQL Injection via the id parameter in all versions up to 1.13.1. The flaw stems from insufficient escaping of user input and inadequate preparation of the SQL query, enabling an authenticated attacker with accounting man...

CVE-2023-2744

CVE-2023-2744 affects the WP ERP WordPress plugin pre-1.12.4. The vulnerability is a SQL injection in the REST endpoint erp/v1/accounting/v1/people where the type parameter is not properly sanitized/escaped before use in a SQL statement, allowing high-privilege users (e.g., admins) to potentially...

CVE-2024-47640

CVE-2024-47640 affects the WP ERP WordPress plugin: a reflected XSS in WP ERP

CVE-2024-21747

CVE-2024-21747 affects the WordPress WP ERP Plugin

CVE-2023-2743

CVE-2023-2743 affects the WordPress WP ERP plugin prior to version 1.12.4. The vulnerability is a Reflected Cross-Site Scripting caused by failing to sanitize/escape the employee_name parameter before echoing it on the page, potentially impacting high-privilege users (e.g., admins). Exploitation ...

CVE-2023-34008

CVE-2023-34008 affects the WordPress WP ERP plugin, with unauthenticated reflected Cross-Site Scripting (XSS) in versions

CVE-2020-36735

The CVE-2020-36735 vulnerability affects the WP ERP plugin for WordPress (versions up to and including 1.6.3). The root cause is missing or incorrect nonce validation on the functions handle_leave_calendar_filter, add_enable_disable_option_save, leave_policies, process_bulk_action, and process_cr...

CVE-2024-12812

CVE-2024-12812 affects the WP ERP plugin for WordPress (WooCommerce CRM & Accounting), specifically versions prior to 1.13.4. The issue is an IDOR that lets authenticated users manipulate parameters to access data of terminated employees. The root cause is improper access control around parameter...

CVE-2024-12808

The CVE-2024-12808 entry concerns the WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin (versions before 1.13.4). According to connected documents, the vulnerability is a Stored Cross-Site Scripting (Stored XSS) flaw caused by insufficie...