Erp Vulnerabilities

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect...

CVSS:

9.8

Affected:

up to 1.17.8

Fixed in:

1.17.9

Disclosed:

Aug 25, 2026

CVE-2026-18080 on NVD →

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

CVSS:

6.5

Affected:

up to 1.17.4

Fixed in:

1.17.5

Disclosed:

Aug 4, 2026

CVE-2026-11421 on NVD →

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,...

CVSS:

4.3

Affected:

up to 1.17.6

Fixed in:

1.17.7

Disclosed:

Jul 16, 2026

CVE-2026-15349 on NVD →

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.17.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an...

CVSS:

4.3

Affected:

up to 1.17.5

Fixed in:

1.17.6

Disclosed:

Jul 15, 2026

CVE-2026-59522 on NVD →

The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.17.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVSS:

6.5

Affected:

up to 1.17.5

Fixed in:

1.17.6

Disclosed:

Jul 8, 2026

CVE-2026-13011 on NVD →

The ERP plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.16.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with crm agent-level access and above, to ap...

CVSS:

6.5

Affected:

up to 1.16.10

Fixed in:

1.16.11

Disclosed:

Feb 5, 2026

CVE-2026-31917 on NVD →

[en] Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs WP ERP erp allows Retrieve Embedded Sensitive Data.This issue affects WP ERP: from n/a through <= 1.16.6.

Affected:

up to 1.16.6

Fix:

No patched version reported

Disclosed:

Dec 18, 2025

CVE-2025-67546 on NVD →

[en] Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.16.7.

Affected:

up to 1.16.7

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-63008 on NVD →

The ERP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.16.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.16.7

Fixed in:

1.16.8

Disclosed:

Dec 4, 2025

CVE-2025-63008 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensi...

CVSS:

4.3

Affected:

up to 1.16.6

Fixed in:

1.16.7

Disclosed:

Nov 26, 2025

CVE-2025-67546 on NVD →

[en] The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.

Affected:

up to 1.13.4

Fixed in:

1.13.4

Disclosed:

May 15, 2025

CVE-2024-12812 on NVD →

[en] The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capabi...

Affected:

up to 1.13.4

Fixed in:

1.13.4

Disclosed:

May 15, 2025

CVE-2024-12808 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.13.4. This makes it possible for authenticated attackers, with Subscriber-lev...

CVSS:

4.3

Affected:

up to 1.13.4

Fixed in:

1.14.0

Disclosed:

Mar 27, 2025

CVE-2025-30896 on NVD →

[en] Missing Authorization vulnerability in weDevs WP ERP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP ERP: from n/a through 1.13.4.

Affected:

up to 1.14.0

Fixed in:

1.14.0

Disclosed:

Mar 27, 2025

CVE-2025-30896 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authen...

CVSS:

4.4

Affected:

up to 1.13.3

Fixed in:

1.13.4

Disclosed:

Mar 3, 2025

CVE-2024-12808 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.13.3 via the profile page due to missing validation on a user controlled key. This makes it possible for authent...

CVSS:

4.3

Affected:

up to 1.13.3

Fixed in:

1.13.4

Disclosed:

Mar 3, 2025

CVE-2024-12812 on NVD →

[en] Missing Authorization vulnerability in weDevs WP ERP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.12.6.

Affected:

up to 1.12.7

Fixed in:

1.12.7

Disclosed:

Jan 2, 2025

CVE-2023-45765 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in weDevs WP ERP allows Reflected XSS.This issue affects WP ERP: from n/a through 1.13.2.

Affected:

up to 1.13.3

Fixed in:

1.13.3

Disclosed:

Oct 29, 2024

CVE-2024-47640 on NVD →

The WP ERP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.13.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a...

CVSS:

6.1

Affected:

up to 1.13.2

Fixed in:

1.13.3

Disclosed:

Oct 21, 2024

CVE-2024-47640 on NVD →

[en] The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ parameter in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wi...

Affected:

up to 1.13.1

Fixed in:

1.13.1

Disclosed:

Jul 11, 2024

CVE-2024-6666 on NVD →

The WP ERP plugin for WordPress is vulnerable to SQL Injection via the ‘vendor_id’ and 'status' parameter in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attac...

CVSS:

8.8

Affected:

up to 1.13.0

Fixed in:

1.13.1

Disclosed:

Jul 10, 2024

CVE-2024-6666 on NVD →

[en] The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar...

Affected:

up to 1.13.2

Fixed in:

1.13.2

Disclosed:

May 2, 2024

CVE-2024-1173 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

CVSS:

7.2

Affected:

up to 1.13.1

Fixed in:

1.13.2

Disclosed:

May 1, 2024

CVE-2024-1173 on NVD →

[en] The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar...

Affected:

up to 1.30.0

Fixed in:

1.30.0

Disclosed:

Apr 9, 2024

CVE-2024-0952 on NVD →

[en] The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union-based SQL Injection via the 'email' parameter in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Affected:

up to 1.12.9

Fix:

No patched version reported

Disclosed:

Mar 29, 2024

CVE-2024-0608 on NVD →

[en] The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter via the erp/v1/accounting/v1/vendors/1/products/ REST route in all versions up to, and including, 1.12.9 due to insufficient escaping...

Affected:

up to 1.12.9

Fix:

No patched version reported

Disclosed:

Mar 29, 2024

CVE-2024-0956 on NVD →

[en] The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to, and including, 1.12.9 due to insufficient escaping on the user sup...

Affected:

up to 1.12.9

Fix:

No patched version reported

Disclosed:

Mar 29, 2024

CVE-2024-0913 on NVD →

[en] The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in all versions up to, and including, 1.12.9 due to insufficient input sanitization and output escaping. This makes it possi...

Affected:

up to 1.12.9

Fix:

No patched version reported

Disclosed:

Mar 29, 2024

CVE-2024-0609 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in all versions up to, and including, 1.13.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVSS:

7.2

Affected:

up to 1.13.1

Fixed in:

1.13.2

Disclosed:

Mar 28, 2024

CVE-2024-0609 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to, and including, 1.13.0 due to insufficient escaping on the user supplied...

CVSS:

7.2

Affected:

up to 1.13.0

Fixed in:

1.13.1

Disclosed:

Mar 28, 2024

CVE-2024-0913 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

CVSS:

7.2

Affected:

up to 1.12.9

Fixed in:

1.13.0

Disclosed:

Mar 28, 2024

CVE-2024-0952 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to union-based SQL Injection via the 'email' parameter in all versions up to, and including, 1.13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa...

CVSS:

6.5

Affected:

up to 1.13.1

Fixed in:

1.13.2

Disclosed:

Mar 28, 2024

CVE-2024-0608 on NVD →

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter via the erp/v1/accounting/v1/vendors/1/products/ REST route in all versions up to, and including, 1.13.0 due to insufficient escaping on th...

CVSS:

4.9

Affected:

up to 1.13.0

Fixed in:

1.13.1

Disclosed:

Mar 28, 2024

CVE-2024-0956 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting.This issue affects WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting:...

Affected:

up to 1.12.9

Fixed in:

1.12.9

Disclosed:

Jan 8, 2024

CVE-2024-21747 on NVD →

The WP ERP plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in versions up to, and including, 1.12.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with accounting man...

CVSS:

7.2

Affected:

up to 1.12.8

Fixed in:

1.12.9

Disclosed:

Jan 5, 2024

CVE-2024-21747 on NVD →

The WP ERP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple admin notice dismissal function in versions up to, and including, 1.12.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to dismiss admin notifica...

CVSS:

4.3

Affected:

up to 1.12.6

Fixed in:

1.12.7

Disclosed:

Oct 12, 2023

CVE-2023-45765 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions.

Affected:

up to 1.12.4

Fixed in:

1.12.4

Disclosed:

Aug 30, 2023

CVE-2023-34008 on NVD →

[en] The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.3. This is due to missing or incorrect nonce validation on the handle_leave_calendar_filter, add_enable_disable_opt...

Affected:

up to 1.6.4

Fixed in:

1.6.4

Disclosed:

Jul 1, 2023

CVE-2020-36735 on NVD →

[en] The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Affected:

up to 1.12.4

Fixed in:

1.12.4

Disclosed:

Jun 27, 2023

CVE-2023-2743 on NVD →

Affected:

up to 1.7.5

Fixed in:

1.7.5

Disclosed:

Jun 7, 2023

CVE-2021-4342 on NVD →

The WP ERP plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in versions up to 1.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access a...

CVSS:

7.2

Affected:

up to 1.12.4

Fixed in:

1.12.4

Disclosed:

Jun 5, 2023

CVE-2023-2744 on NVD →

The WP ERP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'employee_name' parameter in versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execut...

CVSS:

6.1

Affected:

up to 1.12.4

Fixed in:

1.12.4

Disclosed:

Jun 5, 2023

CVE-2023-2743 on NVD →

The WP ERP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a...

CVSS:

6.1

Affected:

up to 1.12.3

Fixed in:

1.12.4

Disclosed:

Jun 2, 2023

CVE-2023-34008 on NVD →

The WP ERP Plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 1.10.5 due to missing authorization checks in a number of functions, including 'generate_csv_url', which leaks a nonce used to import CSV files.

CVSS:

6.3

Affected:

up to 1.10.5

Fixed in:

1.10.6

Disclosed:

Jul 26, 2022

The WP ERP Plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 1.10.5 due to missing authorization checks in a number of functions, including 'generate_csv_url', which leaks a nonce used to import CSV files.

Affected:

up to 1.10.6

Fixed in:

1.10.6

Disclosed:

Jul 26, 2022

Cross-Site Request Forgery (CSRF) vulnerability found by NintechNet in WordPress WP ERP plugin (versions <= 1.7.4).

Affected:

up to 1.7.5

Fixed in:

1.7.5

Disclosed:

Mar 1, 2021

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.3. This is due to missing or incorrect nonce validation on the handle_leave_calendar_filter, add_enable_disable_option_s...

CVSS:

4.3

Affected:

up to 1.6.4

Fixed in:

1.6.4

Disclosed:

Sep 26, 2020

CVE-2020-36735 on NVD →

Cross-Site Request Forgery (CSRF) vulnerability found by Jerome Bruandet (NinTechNet) in WordPress WP ERP plugin (versions <= 1.6.3).

Affected:

up to 1.6.4

Fixed in:

1.6.4

Disclosed:

Sep 16, 2020

Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.

Affected:

up to 1.7.5

Fixed in:

1.7.5