Vulnerabilidades em weDevs
137 resultadosAnálise Vexday
weDevs acumula 44 vulnerabilidades no histórico, com 6 divulgadas nos últimos 90 dias, indicando desenvolvimento contínuo de riscos. Nenhuma vulnerabilidade crítica foi registrada e não há evidência de exploração ativa em ambientes capturados, reduzindo a urgência imediata. A fraqueza predominante é controle de acesso inadequado (CWE-862), sugerindo problemas estruturais de autorização que merecem atenção em avaliações de segurança.
CVE-2025-2541MEDIUMWP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-14348MEDIUMweMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information DisclosureEPSS 0.3%CVE-2024-24711MEDIUMWordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-121760HIGHWordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-11582HIGHSubscribe2 – Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP ParameterEPSS 0.3%CVE-2026-104760MEDIUMweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block AttributeEPSS 0.3%CVE-2024-43238HIGHWordPress weMail plugin <= 1.14.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5459MEDIUMUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription OverwriteEPSS 0.3%CVE-2025-14339MEDIUMweMail <= 2.0.7 - Missing Authorization to Unauthenticated Form DeletionEPSS 0.3%CVE-2026-120070HIGHUser Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content ParameterEPSS 0.3%CVE-2026-115590HIGHWordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerabilityEPSS 0.3%CVE-2025-8994MEDIUMWP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'EPSS 0.3%CVE-2023-3407MEDIUMSubscribe2 <= 10.40 - Cross-Site Request ForgeryEPSS 0.3%CVE-2025-13921MEDIUMweDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post UpdateEPSS 0.3%CVE-2025-3100MEDIUMWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-58269MEDIUMWordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2026-48884MEDIUMWordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-37946MEDIUMWordPress ReCaptcha Integration for WordPress plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4834HIGHWP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' ParameterEPSS 0.3%CVE-2025-58672MEDIUMWordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control VulnerabilityEPSS 0.3%