WP ERP vulnerabilities | LiveThreat CVE Feed

Product

WP ERP

by weDevs · last CVE Sep 30, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities23 In the news0 Timeline

Severity mix

Critical 0High 9Medium 14Low 0

Severity

All severities23 Critical0 High9 Medium14 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add WP ERP to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-6666	8.8	1%	Jul 11	WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id Affected: before 1.13.1
CVE-2026-31917	8.5	0%	Mar 13	WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability Affected: through 1.16.10
CVE-2026-96346	7.6	0%	Sep 30	WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability Affected: through 1.17.9
CVE-2024-12812	7.5	1%	May 15	WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information Affected: before 1.13.4
CVE-2026-96343	7.2	0%	Sep 30	WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability Affected: through 1.17.9
CVE-2024-1173	7.2	1%	May 2	The WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id… Affected: before 1.13.2
CVE-2024-0952	7.2	1%	Apr 9	The WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id… Affected: before 1.13.0
CVE-2024-0913	7.2	1%	Mar 29	The WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the… Affected: through 1.12.9
CVE-2023-2744	7.2	3%	Jun 27	The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL… Affected: before 1.12.4
CVE-2026-59522	6.5	0%	Jul 23	WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability Affected: through 1.17.5
CVE-2025-67546	6.5	0%	Dec 18	WordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerability Affected: through 1.16.6
CVE-2024-0608	6.5	1%	Mar 29	The WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union-based SQL Injection via the 'email'… Affected: through 1.12.9
CVE-2024-47640	6.1	0%	Oct 29	WordPress WP ERP plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 1.13.2
CVE-2024-0609	6.1	1%	Mar 29	The WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… Affected: through 1.12.9
CVE-2023-34008	6.1	0%	Aug 30	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions Affected: through 1.12.3
CVE-2023-2743	6.1	0%	Jun 27	The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting… Affected: before 1.12.4
CVE-2025-30896	5.4	0%	Mar 27	WordPress WP ERP plugin <= 1.13.4 - Broken Access Control vulnerability Affected: through 1.13.4
CVE-2025-63008	5.3	0%	Dec 9	WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability Affected: through 1.16.7
CVE-2024-0956	4.9	1%	Mar 29	The WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id… Affected: through 1.12.9
CVE-2024-21747	4.9	1%	Jan 8	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP \| Complete HR solution with recruitment & job listings \|… Affected: before 1.12.9
CVE-2024-12808	4.8	0%	May 15	WP ERP \| Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS Affected: before 1.13.4
CVE-2023-45765	4.3	0%	Jan 2	WordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerability Affected: through 1.12.6
CVE-2020-36735	4.3	0%	Jul 1	The WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up… Affected: through 1.6.3