Vendor
weDevs vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 57 vulnerabilities in weDevs: 5 in the last 7 days and 28 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126808, was published on 11 November 2026. 12 vulnerabilities in the last four weeks, up 140% on the four before (5). 8 technologies have a page of their own.
- Last 7 days
- 5
- Last 90 days
- 28
- Critical, all time
- 2
- Exploited in the wild
- 0
About weDevs
A software company that develops plugins and solutions for the WordPress ecosystem.
weDevs technologies
Latest weDevs vulnerabilities
- CVE-2026-126808: weDevs ERP authorization bypass in employee profile editingmediumCVSS 4.3
- CVE-2026-124269: weDevs Happy Addons for Elementor broken access controlmediumCVSS 4.3
- CVE-2026-123473: weDevs Happy Addons for Elementor stored cross-site scriptingmediumCVSS 6.5
- CVE-2026-121760: weDevs weDocs broken access control in page visibilityhighCVSS 7.5
- CVE-2026-121767: weDevs weDocs broken access control vulnerabilitymediumCVSS 5.3
- CVE-2026-119487: weDevs Dokan broken access control in user permissionsmediumCVSS 5.3
- CVE-2026-119485: weDevs Dokan broken access controlmediumCVSS 5.3
- CVE-2026-103962: WordPress User Frontend plugin reflected XSS in field_attr parametermediumCVSS 6.1
- CVE-2026-96894: WordPress ERP plugin stored XSS in inbound email bodyhighCVSS 7.2
- CVE-2026-115277: User Frontend WordPress plugin reflected XSS via field_attr parameterinfo
- CVE-2026-109891: weDevs Happy Addons for Elementor broken access controlmediumCVSS 6.4
- CVE-2026-52708: weDevs WP User Frontend broken access controlmediumCVSS 4.3
- CVE-2026-48884: weDevs WP User Frontend broken access controlmediumCVSS 5.3
- CVE-2026-25448: weDevs WP ERP broken access control vulnerabilitymediumCVSS 4.3
- CVE-2026-116850: weDevs Happy Addons for Elementor stored cross-site scriptingmediumCVSS 6.5
- CVE-2026-115590: weDevs Dokan PHP object injectionhighCVSS 7.2
- CVE-2026-97281: WP Project Manager broken access control in subscriber functionalitymediumCVSS 6.3EPSS 0.3%
- CVE-2026-62080: Happy Addons for Elementor cross-site scripting in contributor actionsmediumCVSS 6.5
- CVE-2026-95525: WP User Frontend arbitrary file deletionmediumCVSS 6.5EPSS 0.5%
- CVE-2026-95524: WP User Frontend authentication bypassmediumCVSS 5.3EPSS 0.3%
- CVE-2026-95523: WP User Frontend subscriber privilege bypassmediumCVSS 6.5EPSS 0.3%
- CVE-2026-81283: WP User Frontend PHP object injection vulnerabilityhighCVSS 8.8EPSS 0.5%
- CVE-2026-74930: WP Project Manager unauthorized activity disclosure via IDORmediumCVSS 4.3EPSS 0.3%
- CVE-2026-74929: WP Project Manager privilege escalation via REST API IDORmediumCVSS 5.4EPSS 0.2%
- CVE-2026-74928: WP Project Manager missing authorization in import routeshighCVSS 7.5EPSS 0.4%
Most severe weDevs vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-78262: WP Project Manager PHP Object InjectioncriticalCVSS 9.8EPSS 0.6%
- CVE-2026-56033: Dokan Multivendor Plugin Dokan Pro unauthenticated privilege escalationcriticalCVSS 9.8
- CVE-2026-81283: WP User Frontend PHP object injection vulnerabilityhighCVSS 8.8EPSS 0.5%
- CVE-2026-12224: weDevs Dokan Pro privilege escalation in update_capabilities REST EndpointhighCVSS 8.8
- CVE-2026-49780: weDevs Dokan privilege escalation in WordPress pluginhighCVSS 8.8
- CVE-2026-74928: WP Project Manager missing authorization in import routeshighCVSS 7.5EPSS 0.4%
- CVE-2026-121760: weDevs weDocs broken access control in page visibilityhighCVSS 7.5
- CVE-2026-65495: Dokan Multivendor Dokan Pro broken access controlhighCVSS 7.5
- CVE-2026-65493: Dokan Dokan Pro PHP Object InjectionhighCVSS 7.5
- CVE-2026-12077: weDevs Dokan Pro SQL injection in latitude and longitude parametershighCVSS 7.5
Vulnerabilities per week
12 vulnerabilities in the last four weeks, up 140% on the four before (5). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 2 | 0 | |
| 24 Aug 2026 | 4 | 1 | |
| 31 Aug 2026 | 1 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 3 | 0 | |
| 28 Sep 2026 | 2 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 9 | 0 | |
| 2 Nov 2026 | 3 | 0 | |
| 9 Nov 2026 | 4 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many weDevs vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/wedevs)<a href="https://junglewise.ai/threats/vendors/wedevs"><img src="https://junglewise.ai/threats/vendors/wedevs/badge.svg" alt="weDevs vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/wedevs.json, and this page as text at https://junglewise.ai/threats/vendors/wedevs.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "weDevs vulnerabilities", https://junglewise.ai/threats/vendors/wedevs, 12 November 2026.