weDevs has 13 CVEs on record. Disclosure cadence is accelerating: 11 in the last 90 days against 2 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 7.1 (high). None have a confirmed exploitation report. The most common weakness class is CWE-79 (6). Most affected products: wp-user-frontend (3), erp (2), Dokan Pro (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 11 prev 2
Products
- wp-user-frontend 3
- erp 2
- Dokan Pro 1
- User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission 1
- dokan-lite 1
- happy-elementor-addons 1
Worst active — by depth score
CVE-2026-96346High· 7.6Author SQL Injection in WP ERP <= 1.17.9 versions.42CVE-2026-115590High· 7.2WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability40CVE-2026-96343High· 7.2Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.40CVE-2026-39750High· 7.1Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.39CVE-2026-32572High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.39
weDevs vulnerabilities
CVEs affecting weDevs, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-115590High· 7.2WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.
CVE-2026-96574Medium· 6.4The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter…
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpuf_payment_method' parameter…
CVE-2026-104393Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a thro…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a thro…
CVE-2026-32572High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
CVE-2026-39750High· 7.1Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.
CVE-2026-97281Medium· 6.3Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.
Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.
CVE-2026-96346High· 7.6Author SQL Injection in WP ERP <= 1.17.9 versions.
Author SQL Injection in WP ERP <= 1.17.9 versions.
CVE-2026-96343High· 7.2Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
CVE-2026-95523Medium· 6.5Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
CVE-2026-95525Medium· 6.5Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.
Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.
CVE-2026-95524Medium· 5.3Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
CVE-2026-65492High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.
CVE-2026-57322High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2.