wedevs Vulnerabilities and Affected Products
Vulnerabilities associated with WP User Frontend.
Products
Clear product- Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker11 vulnerabilities
- WP User Frontend9 vulnerabilities
- ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support8 vulnerabilities
- WP ERP8 vulnerabilities
- WP Project Manager7 vulnerabilities
- Dokan Pro6 vulnerabilities
- weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot6 vulnerabilities
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration5 vulnerabilities
- weMail4 vulnerabilities
- wp_erp4 vulnerabilities
- ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce3 vulnerabilities
- Happy Addons for Elementor3 vulnerabilities
- StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce3 vulnerabilities
- Subscribe2 – Form, Email Subscribers & Newsletters3 vulnerabilities
- User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration3 vulnerabilities
- WooCommerce Conversion Tracking3 vulnerabilities
- wp_project_manager3 vulnerabilities
- Appsero Helper2 vulnerabilities
- Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy2 vulnerabilities
- ReCaptcha Integration for WordPress2 vulnerabilities
- weDocs2 vulnerabilities
- weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce2 vulnerabilities
- woocommerce_conversion_tracking2 vulnerabilities
- WP User Frontend Pro2 vulnerabilities
- wp_user_frontend2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-57334MEDIUM | WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions. CWE-862Jun 29, 2026 | CVSS6.5v3.1 | EPSS0.191% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42412MEDIUM | WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerabilityMissing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1. CWE-862Apr 29, 2026 | CVSS6.5v3.1 | EPSS0.195% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-32485HIGH | WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerabilityMissing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.8. CWE-862Mar 25, 2026 | CVSS7.5v3.1 | EPSS0.262% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-24364MEDIUM | WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerabilityMissing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.5. CWE-862Mar 25, 2026 | CVSS6.5v3.1 | EPSS0.311% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-58672MEDIUM | WordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control VulnerabilityMissing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.1.12. CWE-862Sep 22, 2025 | CVSS5.4v3.1 | EPSS0.248% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-58673MEDIUM | WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection VulnerabilityImproper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP User Frontend: from n/a through <= 4.1.12. CWE-94Sep 22, 2025 | CVSS5.4v3.1 | EPSS0.217% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-45002MEDIUM | WordPress WP User Frontend plugin <= 3.6.8 - Broken Access Control vulnerabilityMissing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8. CWE-862Jan 2, 2025 | CVSS4.3v3.1 | EPSS0.312% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-38693HIGH | WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a through 4.0.7. CWE-89Aug 29, 2024 | CVSS7.6v3.1 | EPSS0.438% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47682HIGH | WordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerabilityImproper Privilege Management vulnerability in weDevs WP User Frontend allows Privilege Escalation.This issue affects WP User Frontend: from n/a through 3.6.5. CWE-269May 17, 2024 | CVSS7.2v3.1 | EPSS0.635% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |