Advisories · Technology
wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker.
Every CVE that names wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.8 CriticalCritical · CVSS 9+
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Unrestricted file upload
- CVSS 6.5 Medium
WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- SQL injection
- CVSS 6.4 Medium
WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- SQL injection
- CVSS 6.5 Medium
WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Broken access control
- CVSS 6.5 Medium
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- SQL injection
- CVSS 6.5 Medium
WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Information disclosure
- CVSS 5.3 Medium
WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Broken access control
- CVSS 7.3 High
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Broken access control
- CVSS 8.8 High
WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Privilege escalation
- CVSS 4.3 Medium
WP Project Manager <= 2.4.0 - Cross-Site Request Forgery Bypass
- wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- Cross-site request forgery (CSRF)