Wedevs Wp_erp
16 CVEs affecting Wedevs Wp_erp. Latest disclosed: 2025-05-15. Critical: 0, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6666 | High | 8.8 | 2024-07-11 | The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and including, 1.13.0 due to i… |
CVE-2024-21747 | High | 7.6 | 2024-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & j… |
CVE-2024-12812 | High | 7.5 | 2025-05-15 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue wh… |
CVE-2024-1173 | High | 7.2 | 2024-05-02 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-0952 | High | 7.2 | 2024-04-09 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-0913 | High | 7.2 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-0609 | High | 7.2 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2023-2744 | High | 7.2 | 2023-06-27 | The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before… |
CVE-2024-47640 | High | 7.1 | 2024-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP ERP erp allows Reflected XSS.This issue affects… |
CVE-2023-34008 | High | 7.1 | 2023-08-30 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions. |
CVE-2024-0608 | Medium | 6.5 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union-based SQL Injectio… |
CVE-2023-2743 | Medium | 6.1 | 2023-06-27 | The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-0956 | Medium | 4.9 | 2024-03-29 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection… |
CVE-2024-12808 | Medium | 4.8 | 2025-05-15 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape so… |
CVE-2023-45765 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: fro… |
CVE-2020-36735 | Medium | 4.3 | 2023-07-01 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forge… |