WP ERP vulnerabilities | LiveThreat CVE Feed

Product

WP ERP

by weDevs · last CVE Oct 29, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities24 In the news0 Timeline

Severity mix

Critical 0High 9Medium 15Low 0

Severity

All severities24 Critical0 High9 Medium15 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add WP ERP to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-6666	8.8	1%	Jul 11	WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id Affected: before 1.13.1
CVE-2026-31917	8.5	0%	Mar 13	WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability Affected: through 1.16.10
CVE-2026-96346	7.6	0%	Sep 30	WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability Affected: through 1.17.9
CVE-2024-12812	7.5	1%	May 15	WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information Affected: before 1.13.4
CVE-2026-96343	7.2	0%	Sep 30	WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability Affected: through 1.17.9
CVE-2024-1173	7.2	1%	May 2	WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection Affected: before 1.13.2
CVE-2024-0952	7.2	1%	Apr 9	WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id Affected: before 1.13.0
CVE-2024-0913	7.2	1%	Mar 29	WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection Affected: through 1.12.9
CVE-2023-2744	7.2	3%	Jun 27	WP ERP < 1.12.4 - Admin+ SQL Injection Affected: before 1.12.4
CVE-2026-59522	6.5	0%	Jul 23	WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability Affected: through 1.17.5
CVE-2025-67546	6.5	0%	Dec 18	WordPress WP ERP plugin <= 1.16.6 - Sensitive Data Exposure vulnerability Affected: through 1.16.6
CVE-2024-0608	6.5	1%	Mar 29	WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (Subscriber+) SQL Injection Affected: through 1.12.9
CVE-2024-47640	6.1	0%	Oct 29	WordPress WP ERP plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 1.13.2
CVE-2024-0609	6.1	1%	Mar 29	WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting Affected: through 1.12.9
CVE-2023-34008	6.1	0%	Aug 30	WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS) Affected: through 1.12.3
CVE-2023-2743	6.1	0%	Jun 27	WP ERP < 1.12.4 - Reflected Cross-Site Scripting Affected: before 1.12.4
CVE-2025-30896	5.4	0%	Mar 27	WordPress WP ERP plugin <= 1.13.4 - Broken Access Control vulnerability Affected: through 1.13.4
CVE-2025-63008	5.3	0%	Dec 9	WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability Affected: through 1.16.7
CVE-2024-0956	4.9	1%	Mar 29	WP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL Injection Affected: through 1.12.9
CVE-2024-21747	4.9	1%	Jan 8	WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection Affected: before 1.12.9
CVE-2024-12808	4.8	0%	May 15	WP ERP \| Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS Affected: before 1.13.4
CVE-2026-25448 New	4.3	–	Oct 29	WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability Affected: through 1.17.10
CVE-2023-45765	4.3	0%	Jan 2	WordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerability Affected: through 1.12.6
CVE-2020-36735	4.3	0%	Jul 1	WP ERP \| Complete HR solution with recruitment & job listings \| WooCommerce CRM & Accounting <= 1.6.3 - Cross-Site Request Forgery Bypass Affected: through 1.6.3