{"schema_version":1,"title":"weDevs vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 39 vulnerabilities in weDevs: 3 in the last 7 days and 29 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-95525, was published on 23 September 2026. 6 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/wedevs","json_url":"https://junglewise.ai/threats/vendors/wedevs.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/wedevs","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":10,"all_time":39,"critical":2,"exploited":0,"last_7_days":3,"last_30_days":4,"last_90_days":29,"last_365_days":39},"latest":[{"cve":"CVE-2026-95525","cvss":6.5,"epss":0.0047,"slug":"cve-2026-95525-subscriber-arbitrary-file-deletion-in-wp-user-frontend-4-3-11","title":"WP User Frontend arbitrary file deletion","severity":"medium","exploited":false,"published_at":"2026-09-23T19:19:51.813+00:00","url":"https://junglewise.ai/threats/cve-2026-95525-subscriber-arbitrary-file-deletion-in-wp-user-frontend-4-3-11"},{"cve":"CVE-2026-95524","cvss":5.3,"epss":0.0025,"slug":"cve-2026-95524-unauthenticated-bypass-vulnerability-in-wp-user-frontend-4-3-11","title":"WP User Frontend authentication bypass","severity":"medium","exploited":false,"published_at":"2026-09-23T19:19:51.67+00:00","url":"https://junglewise.ai/threats/cve-2026-95524-unauthenticated-bypass-vulnerability-in-wp-user-frontend-4-3-11"},{"cve":"CVE-2026-95523","cvss":6.5,"epss":0.0034,"slug":"cve-2026-95523-subscriber-bypass-vulnerability-in-wp-user-frontend-4-3-11","title":"WP User Frontend subscriber privilege bypass","severity":"medium","exploited":false,"published_at":"2026-09-23T19:19:51.527+00:00","url":"https://junglewise.ai/threats/cve-2026-95523-subscriber-bypass-vulnerability-in-wp-user-frontend-4-3-11"},{"cve":"CVE-2026-81283","cvss":8.8,"epss":0.0052,"slug":"cve-2026-81283-wp-user-frontend-php-object-injection-vulnerability","title":"WP User Frontend PHP object injection vulnerability","severity":"high","exploited":false,"published_at":"2026-09-02T12:17:12.267+00:00","url":"https://junglewise.ai/threats/cve-2026-81283-wp-user-frontend-php-object-injection-vulnerability"},{"cve":"CVE-2026-74930","cvss":4.3,"epss":0.0027,"slug":"cve-2026-74930-wp-project-manager-unauthorized-activity-disclosure-via-idor","title":"WP Project Manager unauthorized activity disclosure via IDOR","severity":"medium","exploited":false,"published_at":"2026-08-26T06:16:27.133+00:00","url":"https://junglewise.ai/threats/cve-2026-74930-wp-project-manager-unauthorized-activity-disclosure-via-idor"},{"cve":"CVE-2026-74929","cvss":5.4,"epss":0.0023,"slug":"cve-2026-74929-wp-project-manager-privilege-escalation-via-rest-api-idor","title":"WP Project Manager privilege escalation via REST API IDOR","severity":"medium","exploited":false,"published_at":"2026-08-26T06:16:27.037+00:00","url":"https://junglewise.ai/threats/cve-2026-74929-wp-project-manager-privilege-escalation-via-rest-api-idor"},{"cve":"CVE-2026-74928","cvss":7.5,"epss":0.004,"slug":"cve-2026-74928-wp-project-manager-missing-authorization-in-import-routes","title":"WP Project Manager missing authorization in import routes","severity":"high","exploited":false,"published_at":"2026-08-26T06:16:26.93+00:00","url":"https://junglewise.ai/threats/cve-2026-74928-wp-project-manager-missing-authorization-in-import-routes"},{"cve":"CVE-2026-78262","cvss":9.8,"epss":0.0056,"slug":"cve-2026-78262-wp-project-manager-php-object-injection","title":"WP Project Manager PHP Object Injection","severity":"critical","exploited":false,"published_at":"2026-08-24T22:17:19.947+00:00","url":"https://junglewise.ai/threats/cve-2026-78262-wp-project-manager-php-object-injection"},{"cve":"CVE-2026-16577","cvss":2.7,"epss":0.0028,"slug":"cve-2026-16577-dokan-reverse-withdrawal-ledger-manipulation-via-client-supplied","title":"Dokan reverse withdrawal ledger manipulation via client-supplied amount","severity":"low","exploited":false,"published_at":"2026-08-21T07:16:24.84+00:00","url":"https://junglewise.ai/threats/cve-2026-16577-dokan-reverse-withdrawal-ledger-manipulation-via-client-supplied"},{"cve":"CVE-2026-16575","cvss":5.3,"epss":0.0035,"slug":"cve-2026-16575-dokan-wordpress-plugin-unauthenticated-commission-settings","title":"Dokan WordPress plugin unauthenticated commission settings disclosure","severity":"medium","exploited":false,"published_at":"2026-08-21T07:16:24.637+00:00","url":"https://junglewise.ai/threats/cve-2026-16575-dokan-wordpress-plugin-unauthenticated-commission-settings"},{"cve":"CVE-2026-66699","cvss":5.3,"epss":0.0029,"slug":"cve-2026-66699-dokan-broken-access-control-in-custom-roles","title":"Dokan broken access control in custom roles","severity":"medium","exploited":false,"published_at":"2026-08-06T15:17:22.853+00:00","url":"https://junglewise.ai/threats/cve-2026-66699-dokan-broken-access-control-in-custom-roles"},{"cve":"CVE-2026-15411","cvss":5.3,"slug":"cve-2026-15411-wedevs-storegrowth-authorization-bypass-in-sales-pop-module","title":"weDevs StoreGrowth authorization bypass in Sales Pop module","severity":"medium","exploited":false,"published_at":"2026-07-28T12:16:35.63+00:00","url":"https://junglewise.ai/threats/cve-2026-15411-wedevs-storegrowth-authorization-bypass-in-sales-pop-module"},{"cve":"CVE-2026-13440","cvss":7.2,"slug":"cve-2026-13440-wedevs-storegrowth-stored-xss-via-message-popup-parameter","title":"wedevs StoreGrowth Stored XSS via message_popup parameter","severity":"high","exploited":false,"published_at":"2026-07-28T12:16:35.34+00:00","url":"https://junglewise.ai/threats/cve-2026-13440-wedevs-storegrowth-stored-xss-via-message-popup-parameter"},{"cve":"CVE-2026-13110","cvss":5.3,"slug":"cve-2026-13110-wedevs-storegrowth-sales-booster-missing-authorization-in-ajax","title":"wedevs Storegrowth Sales Booster missing authorization in AJAX handler","severity":"medium","exploited":false,"published_at":"2026-07-28T12:16:35.21+00:00","url":"https://junglewise.ai/threats/cve-2026-13110-wedevs-storegrowth-sales-booster-missing-authorization-in-ajax"},{"cve":"CVE-2026-14568","cvss":6.5,"slug":"cve-2026-14568-wp-user-frontend-unauthenticated-attachment-deletion","title":"WP User Frontend unauthenticated attachment deletion","severity":"info","exploited":false,"published_at":"2026-07-27T07:16:25.987+00:00","url":"https://junglewise.ai/threats/cve-2026-14568-wp-user-frontend-unauthenticated-attachment-deletion"},{"cve":"CVE-2026-65495","cvss":7.5,"slug":"cve-2026-65495-dokan-multivendor-dokan-pro-broken-access-control","title":"Dokan Multivendor Dokan Pro broken access control","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:42.79+00:00","url":"https://junglewise.ai/threats/cve-2026-65495-dokan-multivendor-dokan-pro-broken-access-control"},{"cve":"CVE-2026-65494","cvss":7.1,"slug":"cve-2026-65494-dokan-dokan-pro-sql-injection-in-subscriber-role","title":"Dokan Dokan Pro SQL injection in Subscriber role","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:42.677+00:00","url":"https://junglewise.ai/threats/cve-2026-65494-dokan-dokan-pro-sql-injection-in-subscriber-role"},{"cve":"CVE-2026-65493","cvss":7.5,"slug":"cve-2026-65493-dokan-dokan-pro-php-object-injection","title":"Dokan Dokan Pro PHP Object Injection","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:42.553+00:00","url":"https://junglewise.ai/threats/cve-2026-65493-dokan-dokan-pro-php-object-injection"},{"cve":"CVE-2026-65492","cvss":7.1,"slug":"cve-2026-65492-wedevs-dokan-pro-unauthenticated-xss","title":"weDevs Dokan Pro unauthenticated XSS","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:42.43+00:00","url":"https://junglewise.ai/threats/cve-2026-65492-wedevs-dokan-pro-unauthenticated-xss"},{"cve":"CVE-2026-59522","cvss":6.5,"slug":"cve-2026-59522-wedevs-wp-erp-broken-access-control-in-wordpress-plugin","title":"weDevs WP ERP broken access control in WordPress plugin","severity":"medium","exploited":false,"published_at":"2026-07-23T12:18:32.347+00:00","url":"https://junglewise.ai/threats/cve-2026-59522-wedevs-wp-erp-broken-access-control-in-wordpress-plugin"},{"cve":"CVE-2026-13011","cvss":6.5,"slug":"cve-2026-13011-wedevs-wp-erp-sql-injection-in-orderby-parameter","title":"weDevs WP ERP SQL injection in orderby parameter","severity":"medium","exploited":false,"published_at":"2026-07-09T08:16:46.13+00:00","url":"https://junglewise.ai/threats/cve-2026-13011-wedevs-wp-erp-sql-injection-in-orderby-parameter"},{"cve":"CVE-2026-12418","cvss":5.3,"slug":"cve-2026-12418-wedevs-wp-user-frontend-idor-in-wpuf-files-data","title":"wedevs WP User Frontend IDOR in wpuf_files_data","severity":"medium","exploited":false,"published_at":"2026-07-09T08:16:46+00:00","url":"https://junglewise.ai/threats/cve-2026-12418-wedevs-wp-user-frontend-idor-in-wpuf-files-data"},{"cve":"CVE-2026-12406","cvss":5.3,"slug":"cve-2026-12406-wedevs-user-frontend-authorization-bypass-in-wpuf-file-del-ajax","title":"wedevs User Frontend authorization bypass in wpuf_file_del AJAX action","severity":"medium","exploited":false,"published_at":"2026-07-09T08:16:45.85+00:00","url":"https://junglewise.ai/threats/cve-2026-12406-wedevs-user-frontend-authorization-bypass-in-wpuf-file-del-ajax"},{"cve":"CVE-2026-5459","cvss":5.3,"slug":"cve-2026-5459-wedevs-wp-user-frontend-idor-in-payment-page-function","title":"weDevs WP User Frontend IDOR in payment_page function","severity":"medium","exploited":false,"published_at":"2026-07-08T13:16:56.887+00:00","url":"https://junglewise.ai/threats/cve-2026-5459-wedevs-wp-user-frontend-idor-in-payment-page-function"},{"cve":"CVE-2026-12734","cvss":6.4,"slug":"cve-2026-12734-wedevs-wedocs-stored-xss-in-connectorwidth-block-attribute","title":"weDevs weDocs Stored XSS in connectorWidth Block Attribute","severity":"medium","exploited":false,"published_at":"2026-07-03T02:16:23.223+00:00","url":"https://junglewise.ai/threats/cve-2026-12734-wedevs-wedocs-stored-xss-in-connectorwidth-block-attribute"}],"vendor":{"hub":true,"name":"weDevs","slug":"wedevs","homepage":"https://wedevs.com/","description":"A software company that develops plugins and solutions for the WordPress ecosystem.","url":"https://junglewise.ai/threats/vendors/wedevs"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-08-24","critical":1,"exploited":0,"vulnerabilities":4},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":3}],"most_severe":[{"cve":"CVE-2026-78262","cvss":9.8,"epss":0.0056,"slug":"cve-2026-78262-wp-project-manager-php-object-injection","title":"WP Project Manager PHP Object Injection","severity":"critical","exploited":false,"published_at":"2026-08-24T22:17:19.947+00:00","url":"https://junglewise.ai/threats/cve-2026-78262-wp-project-manager-php-object-injection"},{"cve":"CVE-2026-56033","cvss":9.8,"slug":"cve-2026-56033-dokan-multivendor-plugin-dokan-pro-unauthenticated-privilege","title":"Dokan Multivendor Plugin Dokan Pro unauthenticated privilege escalation","severity":"critical","exploited":false,"published_at":"2026-06-26T15:16:43.26+00:00","url":"https://junglewise.ai/threats/cve-2026-56033-dokan-multivendor-plugin-dokan-pro-unauthenticated-privilege"},{"cve":"CVE-2026-81283","cvss":8.8,"epss":0.0052,"slug":"cve-2026-81283-wp-user-frontend-php-object-injection-vulnerability","title":"WP User Frontend PHP object injection vulnerability","severity":"high","exploited":false,"published_at":"2026-09-02T12:17:12.267+00:00","url":"https://junglewise.ai/threats/cve-2026-81283-wp-user-frontend-php-object-injection-vulnerability"},{"cve":"CVE-2026-12224","cvss":8.8,"slug":"cve-2026-12224-wedevs-dokan-pro-privilege-escalation-in-update-capabilities-rest","title":"weDevs Dokan Pro privilege escalation in update_capabilities REST Endpoint","severity":"high","exploited":false,"published_at":"2026-07-01T08:16:20.827+00:00","url":"https://junglewise.ai/threats/cve-2026-12224-wedevs-dokan-pro-privilege-escalation-in-update-capabilities-rest"},{"cve":"CVE-2026-49780","cvss":8.8,"slug":"cve-2026-49780-wedevs-dokan-privilege-escalation-in-wordpress-plugin","title":"weDevs Dokan privilege escalation in WordPress plugin","severity":"high","exploited":false,"published_at":"2026-06-15T21:17:22.52+00:00","url":"https://junglewise.ai/threats/cve-2026-49780-wedevs-dokan-privilege-escalation-in-wordpress-plugin"},{"cve":"CVE-2026-74928","cvss":7.5,"epss":0.004,"slug":"cve-2026-74928-wp-project-manager-missing-authorization-in-import-routes","title":"WP Project Manager missing authorization in import routes","severity":"high","exploited":false,"published_at":"2026-08-26T06:16:26.93+00:00","url":"https://junglewise.ai/threats/cve-2026-74928-wp-project-manager-missing-authorization-in-import-routes"},{"cve":"CVE-2026-65495","cvss":7.5,"slug":"cve-2026-65495-dokan-multivendor-dokan-pro-broken-access-control","title":"Dokan Multivendor Dokan Pro broken access control","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:42.79+00:00","url":"https://junglewise.ai/threats/cve-2026-65495-dokan-multivendor-dokan-pro-broken-access-control"},{"cve":"CVE-2026-65493","cvss":7.5,"slug":"cve-2026-65493-dokan-dokan-pro-php-object-injection","title":"Dokan Dokan Pro PHP Object Injection","severity":"high","exploited":false,"published_at":"2026-07-23T12:18:42.553+00:00","url":"https://junglewise.ai/threats/cve-2026-65493-dokan-dokan-pro-php-object-injection"},{"cve":"CVE-2026-12077","cvss":7.5,"slug":"cve-2026-12077-wedevs-dokan-pro-sql-injection-in-latitude-and-longitude","title":"weDevs Dokan Pro SQL injection in latitude and longitude parameters","severity":"high","exploited":false,"published_at":"2026-06-25T04:17:55.627+00:00","url":"https://junglewise.ai/threats/cve-2026-12077-wedevs-dokan-pro-sql-injection-in-latitude-and-longitude"},{"cve":"CVE-2026-13440","cvss":7.2,"slug":"cve-2026-13440-wedevs-storegrowth-stored-xss-via-message-popup-parameter","title":"wedevs StoreGrowth Stored XSS via message_popup parameter","severity":"high","exploited":false,"published_at":"2026-07-28T12:16:35.34+00:00","url":"https://junglewise.ai/threats/cve-2026-13440-wedevs-storegrowth-stored-xss-via-message-popup-parameter"}],"generated_at":"2026-09-26T12:07:00.15149+00:00","technologies":[{"name":"weDevs WP User Frontend","slug":"user-frontend","vulnerabilities":10,"url":"https://junglewise.ai/threats/technologies/user-frontend"},{"name":"weDevs Dokan Pro","slug":"dokan-pro","vulnerabilities":8,"url":"https://junglewise.ai/threats/technologies/dokan-pro"},{"name":"weDevs Dokan","slug":"dokan","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/dokan"},{"name":"weDevs weDocs","slug":"wedocs","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/wedocs"},{"name":"weDevs WP Project Manager","slug":"wp-project-manager","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/wp-project-manager"},{"name":"weDevs StoreGrowth","slug":"storegrowth","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/storegrowth"}]}