wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker version is affected

Latest wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker vulnerabilities

CVE-2026-97281 — WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability (CVSS 6.3)
CVE-2026-78262 — WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability (CVSS 9.8)
CVE-2025-68040 — WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability (CVSS 6.5)
CVE-2025-8994 — WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator' (CVSS 6.5)
CVE-2025-58269 — WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability (CVSS 5.3)
CVE-2025-2541 — WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 5.4)
CVE-2025-3100 — WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload (CVSS 5.4)
CVE-2025-32280 — WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8)
CVE-2025-22649 — WordPress WP Project Manager plugin <= 2.6.22 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
CVE-2024-13500 — WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter (CVSS 6.5)
CVE-2024-13752 — WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update (CVSS 6.5)
CVE-2024-12195 — WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
CVE-2024-10548 — WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API (CVSS 6.5)
CVE-2023-40003 — WordPress WP Project Manager plugin <= 2.6.7 - Broken Access Control vulnerability (CVSS 9.8)
CVE-2024-12015 — SQL Injection in WordPress Project Manager Plugin (CVSS 7.7)
CVE-2024-10520 — WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion (CVSS 5.3)
CVE-2024-10174 — WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass (CVSS 7.3)
CVE-2023-49860 — WordPress WP Project Manager Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
CVE-2023-34383 — WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection (CVSS 9.8)
CVE-2023-3636 — WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
CVE-2020-36745 — WP Project Manager <= 2.4.0 - Cross-Site Request Forgery Bypass (CVSS 8.8)
CVE-2021-36826 — WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4)