PM
Product
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
9
CVEs
0
On KEV
7.3
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 8Low 0
Watch
Add Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-8994 | 6.5 | Nov 15 | WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator' Affected: through 2.6.26 |
| CVE-2024-13500 | 6.5 | Feb 15 | WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter Affected: through 2.6.17 |
| CVE-2024-13752 | 6.5 | Feb 15 | WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update Affected: through 2.6.17 |
| CVE-2024-12195 | 6.5 | Jan 4 | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection Affected: through 2.6.16 |
| CVE-2024-10548 | 6.5 | Dec 19 | WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API Affected: through 2.6.15 |
| CVE-2025-2541 | 5.4 | Apr 11 | WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Affected: through 2.6.22 |
| CVE-2025-3100 | 5.4 | Apr 9 | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload Affected: through 2.6.22 |
| CVE-2024-10520 | 5.3 | Nov 20 | WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion Affected: through 2.6.14 |
Showing 8