Project Manager – Ai Powered Project Management, Task Management, Kanban Board & Time Tracker

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:wedevs:project_manager_–_ai_powered_project_management,_task_management,_kanban_board_&_time_tracker:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorWedevs (74af2ef9-c755-5b07-93a2-5a3afa051904)
ProductProject Manager – Ai Powered Project Management, Task Management, Kanban Board & Time Tracker (db3a139d-1f2d-5a14-a7c0-b41777267cf7)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-8994 vulnerable 2026-06-08 07:45:21.555642 WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'
MEDIUM (6.5)
The Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘completed_at_operator’ parameter in all versions up to, and including, 2.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-11-15T05:45:33.608Z
Updated: 2026-04-08T17:01:10.944Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-3100 vulnerable 2026-06-08 07:23:08.110994 WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
MEDIUM (6.4)
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Published: 2025-04-09T04:21:20.345Z
Updated: 2026-04-08T16:51:27.778Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-2541 vulnerable 2026-06-08 07:16:57.387864 WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
MEDIUM (6.4)
The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Published: 2025-04-11T11:11:56.437Z
Updated: 2026-04-08T17:27:53.680Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-13752 vulnerable 2026-06-08 06:25:38.465458 WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
MEDIUM (6.5)
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cause a persistent denial of service condition.
Published: 2025-02-15T09:24:23.809Z
Updated: 2026-04-08T17:18:57.189Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-13500 vulnerable 2026-06-08 06:25:37.822350 WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
MEDIUM (6.5)
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Published: 2025-02-15T11:26:48.217Z
Updated: 2026-04-08T17:00:15.994Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-12195 vulnerable 2026-06-08 06:23:51.422013 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-10548 vulnerable 2026-06-08 06:23:46.922887 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-10520 vulnerable 2026-06-08 06:23:46.844952 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-10174 vulnerable 2026-06-08 06:22:03.722566 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-3636 vulnerable 2026-06-08 06:09:40.065011 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-36745 vulnerable 2026-06-08 05:25:49.520930 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.