Vulnerabilidades en wedevs

100 resultados
Análisis Vexday

A WEDevs apresenta 50 vulnerabilidades catalogadas, com 13 descobertas nos últimos 90 dias, indicando atividade contínua. Nenhuma das vulnerabilidades está sob ataque ativo (KEV), e apenas 1 é classificada como crítica, reduzindo o risco imediato. A injeção SQL (CWE-89) é a fraqueza predominante, sugerindo falhas em validação de entrada que demandam remediação prioritária.

CVE-2025-68040MEDIUMWordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2025-67546MEDIUMWordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2025-12505MEDIUMweDocs <= 2.1.14 - Missing Authorization to Settings UpdateEPSS 0.2%CVE-2025-58673MEDIUMWordPress WP User Frontend Plugin <= 4.1.12 - Content Injection VulnerabilityEPSS 0.2%CVE-2026-12079MEDIUMDokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' ParameterEPSS 0.2%CVE-2026-12729MEDIUMweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX ActionEPSS 0.2%CVE-2025-12809MEDIUMdokan pro <= 4.1.3 - Missing Authorization to Unauthenticated Sensitive Information ExposureEPSS 0.2%CVE-2026-12734MEDIUMweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block AttributeEPSS 0.2%CVE-2026-12731MEDIUMweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block AttributesEPSS 0.2%CVE-2026-42412MEDIUMWordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-2233MEDIUMUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' ParameterEPSS 0.2%CVE-2026-57334MEDIUMWordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-39520MEDIUMWordPress weDocs plugin <= 2.1.18 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-5459MEDIUMUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription OverwriteEPSS 0.2%CVE-2026-57322HIGHWordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24944MEDIUMWordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-32280MEDIUMWordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.2%CVE-2026-4058MEDIUMUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack CancellationEPSS 0.2%CVE-2024-13436MEDIUMAppsero Helper <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.1%CVE-2022-47150MEDIUMWordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.1%