WP
Product
WP Project Manager
21
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 5Medium 13Low 0
Watch
Add WP Project Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-78262 | 9.8 | Aug 24 | WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability Affected: through 4.0.6 |
| CVE-2023-40003 | 9.8 | Dec 13 | WordPress WP Project Manager plugin <= 2.6.7 - Broken Access Control vulnerability Affected: through 2.6.7 |
| CVE-2023-34383 | 9.8 | Nov 3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows SQL Injection.This… Affected: through 2.6.0 |
| CVE-2025-32280 | 8.8 | Apr 4 | WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability Affected: through 2.6.25 |
| CVE-2023-3636 | 8.8 | Aug 31 | The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the… Affected: before 2.6.5 |
| CVE-2020-36745 | 8.8 | Jul 1 | The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0 Affected: through 2.4.0 |
| CVE-2024-12015 | 7.7 | Dec 2 | SQL Injection in WordPress Project Manager Plugin Affected: 0 |
| CVE-2024-10174 | 7.3 | Nov 13 | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass Affected: before 2.6.14 |
| CVE-2025-68040 | 6.5 | Dec 29 | WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability Affected: through 3.0.1 |
| CVE-2024-13500 | 6.5 | Feb 15 | WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter Affected: before 2.6.18 |
| CVE-2024-13752 | 6.5 | Feb 15 | WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update Affected: before 2.6.18 |
| CVE-2024-12195 | 6.5 | Jan 4 | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection Affected: before 2.6.17 |
| CVE-2024-10548 | 6.5 | Dec 19 | WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API Affected: before 2.6.16 |
| CVE-2026-97281 | 6.3 | Oct 1 | WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability Affected: through 4.0.7 |
| CVE-2025-2541 | 5.4 | Apr 11 | WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Affected: before 2.6.23 |
| CVE-2025-3100 | 5.4 | Apr 9 | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload Affected: before 2.6.23 |
| CVE-2023-49860 | 5.4 | Dec 14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager – Task, team, and project management plugin… Affected: through 2.6.7 |
| CVE-2021-36826 | 5.4 | Apr 4 | Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions Affected: before 2.4.14 |
| CVE-2025-58269 | 5.3 | Sep 22 | WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability Affected: through 2.6.25 |
| CVE-2024-10520 | 5.3 | Nov 20 | WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion Affected: before 2.6.15 |
| CVE-2025-22649 | 4.8 | Mar 27 | WordPress WP Project Manager plugin <= 2.6.22 - Cross Site Scripting (XSS) vulnerability Affected: through 2.6.22 |
Showing 21