# weDevs vulnerabilities Source: https://junglewise.ai/threats/vendors/wedevs Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/wedevs.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 57 vulnerabilities in weDevs: 5 in the last 7 days and 28 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126808, was published on 11 November 2026. 12 vulnerabilities in the last four weeks, up 140% on the four before (5). 8 technologies have a page of their own. ## Counts - Last 7 days: 5 - Last 30 days: 16 - Last 90 days: 28 - All time: 57 (2 critical, 0 exploited in the wild) ## About weDevs A software company that develops plugins and solutions for the WordPress ecosystem. ## Latest weDevs vulnerabilities - [CVE-2026-126808: weDevs ERP authorization bypass in employee profile editing](https://junglewise.ai/threats/cve-2026-126808-wedevs-erp-wp-erp-through-1-17-11-contains-an-incorrect) (medium, CVSS 4.3, published 11 Nov 2026) - [CVE-2026-124269: weDevs Happy Addons for Elementor broken access control](https://junglewise.ai/threats/cve-2026-124269-missing-authorization-vulnerability-in-wedevs-happy-addons-for) (medium, CVSS 4.3, published 11 Nov 2026) - [CVE-2026-123473: weDevs Happy Addons for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123473-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-121760: weDevs weDocs broken access control in page visibility](https://junglewise.ai/threats/cve-2026-121760-missing-authorization-vulnerability-in-wedevs-wedocs-wedocs) (high, CVSS 7.5, published 9 Nov 2026) - [CVE-2026-121767: weDevs weDocs broken access control vulnerability](https://junglewise.ai/threats/cve-2026-121767-missing-authorization-vulnerability-in-wedevs-wedocs-wedocs) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-119487: weDevs Dokan broken access control in user permissions](https://junglewise.ai/threats/cve-2026-119487-missing-authorization-vulnerability-in-wedevs-dokan-dokan-lite) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-119485: weDevs Dokan broken access control](https://junglewise.ai/threats/cve-2026-119485-missing-authorization-vulnerability-in-wedevs-dokan-dokan-lite) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-103962: WordPress User Frontend plugin reflected XSS in field_attr parameter](https://junglewise.ai/threats/cve-2026-103962-the-user-frontend-membership-user-registration-user-profile-user) (medium, CVSS 6.1, published 31 Oct 2026) - [CVE-2026-96894: WordPress ERP plugin stored XSS in inbound email body](https://junglewise.ai/threats/cve-2026-96894-the-erp-complete-hr-accounting-crm-suite-built-for-woocommerce) (high, CVSS 7.2, published 30 Oct 2026) - [CVE-2026-115277: User Frontend WordPress plugin reflected XSS via field_attr parameter](https://junglewise.ai/threats/cve-2026-115277-the-user-frontend-wordpress-plugin-before-4-3-14-does-not) (info, published 30 Oct 2026) - [CVE-2026-109891: weDevs Happy Addons for Elementor broken access control](https://junglewise.ai/threats/cve-2026-109891-missing-authorization-vulnerability-in-wedevs-happy-addons-for) (medium, CVSS 6.4, published 29 Oct 2026) - [CVE-2026-52708: weDevs WP User Frontend broken access control](https://junglewise.ai/threats/cve-2026-52708-missing-authorization-vulnerability-in-wedevs-wp-user-frontend-wp) (medium, CVSS 4.3, published 29 Oct 2026) - [CVE-2026-48884: weDevs WP User Frontend broken access control](https://junglewise.ai/threats/cve-2026-48884-missing-authorization-vulnerability-in-wedevs-wp-user-frontend-wp) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-25448: weDevs WP ERP broken access control vulnerability](https://junglewise.ai/threats/cve-2026-25448-missing-authorization-vulnerability-in-wedevs-wp-erp-erp-allows) (medium, CVSS 4.3, published 29 Oct 2026) - [CVE-2026-116850: weDevs Happy Addons for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116850-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-115590: weDevs Dokan PHP object injection](https://junglewise.ai/threats/cve-2026-115590-deserialization-of-untrusted-data-vulnerability-in-wedevs-dokan) (high, CVSS 7.2, published 28 Oct 2026) - [CVE-2026-97281: WP Project Manager broken access control in subscriber functionality](https://junglewise.ai/threats/cve-2026-97281-subscriber-broken-access-control-in-wp-project-manager-4-0-7) (medium, CVSS 6.3, published 1 Oct 2026) - [CVE-2026-62080: Happy Addons for Elementor cross-site scripting in contributor actions](https://junglewise.ai/threats/cve-2026-62080-contributor-cross-site-scripting-xss-in-happy-addons-for) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-95525: WP User Frontend arbitrary file deletion](https://junglewise.ai/threats/cve-2026-95525-subscriber-arbitrary-file-deletion-in-wp-user-frontend-4-3-11) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-95524: WP User Frontend authentication bypass](https://junglewise.ai/threats/cve-2026-95524-unauthenticated-bypass-vulnerability-in-wp-user-frontend-4-3-11) (medium, CVSS 5.3, published 23 Sep 2026) - [CVE-2026-95523: WP User Frontend subscriber privilege bypass](https://junglewise.ai/threats/cve-2026-95523-subscriber-bypass-vulnerability-in-wp-user-frontend-4-3-11) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-81283: WP User Frontend PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-81283-wp-user-frontend-php-object-injection-vulnerability) (high, CVSS 8.8, published 2 Sep 2026) - [CVE-2026-74930: WP Project Manager unauthorized activity disclosure via IDOR](https://junglewise.ai/threats/cve-2026-74930-wp-project-manager-unauthorized-activity-disclosure-via-idor) (medium, CVSS 4.3, published 26 Aug 2026) - [CVE-2026-74929: WP Project Manager privilege escalation via REST API IDOR](https://junglewise.ai/threats/cve-2026-74929-wp-project-manager-privilege-escalation-via-rest-api-idor) (medium, CVSS 5.4, published 26 Aug 2026) - [CVE-2026-74928: WP Project Manager missing authorization in import routes](https://junglewise.ai/threats/cve-2026-74928-wp-project-manager-missing-authorization-in-import-routes) (high, CVSS 7.5, published 26 Aug 2026) ## Most severe weDevs vulnerabilities - [CVE-2026-78262: WP Project Manager PHP Object Injection](https://junglewise.ai/threats/cve-2026-78262-wp-project-manager-php-object-injection) (critical, CVSS 9.8, published 24 Aug 2026) - [CVE-2026-56033: Dokan Multivendor Plugin Dokan Pro unauthenticated privilege escalation](https://junglewise.ai/threats/cve-2026-56033-dokan-multivendor-plugin-dokan-pro-unauthenticated-privilege) (critical, CVSS 9.8, published 26 Jun 2026) - [CVE-2026-81283: WP User Frontend PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-81283-wp-user-frontend-php-object-injection-vulnerability) (high, CVSS 8.8, published 2 Sep 2026) - [CVE-2026-12224: weDevs Dokan Pro privilege escalation in update_capabilities REST Endpoint](https://junglewise.ai/threats/cve-2026-12224-wedevs-dokan-pro-privilege-escalation-in-update-capabilities-rest) (high, CVSS 8.8, published 1 Jul 2026) - [CVE-2026-49780: weDevs Dokan privilege escalation in WordPress plugin](https://junglewise.ai/threats/cve-2026-49780-wedevs-dokan-privilege-escalation-in-wordpress-plugin) (high, CVSS 8.8, published 15 Jun 2026) - [CVE-2026-74928: WP Project Manager missing authorization in import routes](https://junglewise.ai/threats/cve-2026-74928-wp-project-manager-missing-authorization-in-import-routes) (high, CVSS 7.5, published 26 Aug 2026) - [CVE-2026-121760: weDevs weDocs broken access control in page visibility](https://junglewise.ai/threats/cve-2026-121760-missing-authorization-vulnerability-in-wedevs-wedocs-wedocs) (high, CVSS 7.5, published 9 Nov 2026) - [CVE-2026-65495: Dokan Multivendor Dokan Pro broken access control](https://junglewise.ai/threats/cve-2026-65495-dokan-multivendor-dokan-pro-broken-access-control) (high, CVSS 7.5, published 23 Jul 2026) - [CVE-2026-65493: Dokan Dokan Pro PHP Object Injection](https://junglewise.ai/threats/cve-2026-65493-dokan-dokan-pro-php-object-injection) (high, CVSS 7.5, published 23 Jul 2026) - [CVE-2026-12077: weDevs Dokan Pro SQL injection in latitude and longitude parameters](https://junglewise.ai/threats/cve-2026-12077-wedevs-dokan-pro-sql-injection-in-latitude-and-longitude) (high, CVSS 7.5, published 25 Jun 2026) ## Vulnerabilities per week 12 vulnerabilities in the last four weeks, up 140% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 2 | 0 | 0 | | 24 Aug 2026 | 4 | 1 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 9 | 0 | 0 | | 2 Nov 2026 | 3 | 0 | 0 | | 9 Nov 2026 | 4 | 0 | 0 | ## weDevs technologies - [weDevs WP User Frontend](https://junglewise.ai/threats/technologies/user-frontend): 17 vulnerabilities - [weDevs Dokan](https://junglewise.ai/threats/technologies/dokan): 10 vulnerabilities - [weDevs Dokan Pro](https://junglewise.ai/threats/technologies/dokan-pro): 8 vulnerabilities - [weDevs weDocs](https://junglewise.ai/threats/technologies/wedocs): 6 vulnerabilities - [weDevs Happy Addons for Elementor](https://junglewise.ai/threats/technologies/wedevs-happy-addons-for-elementor): 5 vulnerabilities - [weDevs WP Project Manager](https://junglewise.ai/threats/technologies/wp-project-manager): 5 vulnerabilities - [weDevs WP ERP](https://junglewise.ai/threats/technologies/wp-erp): 4 vulnerabilities - [weDevs StoreGrowth](https://junglewise.ai/threats/technologies/storegrowth): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "weDevs vulnerabilities", https://junglewise.ai/threats/vendors/wedevs, 12 November 2026.