These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress has an authorization bypass vulnerability in all versions up to, and including, 1.17.6. Authenticated attackers with subscriber-level access and above can create arbitrary company locations in the ERP database. This vulnerability has a CVSS score of 4.3 and a severity of MEDIUM. The vulnerability was reported by securi [truncated]
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for [truncated]
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versions up to, and including, 2.3.0. This vulnerability is caused by insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above [truncated]
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4. This vulnerability allows unauthenticated attackers to append additional SQL queries into existing queries, potentially leading to sensitive information disclosure. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severit [truncated]
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in weDevs WooCommerce Conversion Tracking, affecting versions from n/a through 2.0.10. This vulnerability has been assigned a CVSS score of 4.3, indicating a Medium severity level. The vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks.
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_subscription_cancel() function in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel any user [truncated]
CVE-2026-4834 describes an unauthenticated SQL injection in the WP ERP Pro plugin for WordPress affecting all versions up to and including 1.5.1. The issue is tied to insufficient escaping and insufficient query preparation for the user-supplied search_key parameter. Because the flaw can be reached without authentication and is associated with high confidentiality impact, it should be treated as a priorit [truncated]
A Missing Authorization vulnerability in the weDevs weDocs plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects weDocs: from n/a through <= 2.1.18. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. Users of weDevs weDocs plugin, especially those with versions from n/a through <= 2.1.18, should be aware of this MEDIUM severity vuln [truncated]