Plugin icon

ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support

erp

Vulnerabilities:

21

Last Updated:

May 13, 2026

Active Installs:

6000

Published
Title
Fixed in
CVSS
Published
2026-02-05
Title
ERP < 1.16.11 - Authenticated (Crm agent+) SQL Injection
Fixed in
Fixed in 1.16.11
CVSS
6.5 (medium)
Published
2025-12-04
Title
ERP < 1.16.8 - Missing Authorization
Fixed in
Fixed in 1.16.8
CVSS
5.3 (medium)
Published
2025-11-26
Title
ERP < 1.16.7 - Authenticated (Subscriber+) Information Exposure
Fixed in
Fixed in 1.16.7
CVSS
4.3 (medium)
Published
2025-03-27
Title
WP ERP < 1.14.0 - Missing Authorization
Fixed in
Fixed in 1.14.0
CVSS
4.3 (medium)
Published
2024-11-12
Title
WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS
Fixed in
Fixed in 1.13.4
CVSS
3.5 (low)
Published
2024-11-12
Title
WP ERP < 1.13.4 - Unauthorized Access to Terminated Employee Information
Fixed in
Fixed in 1.13.4
CVSS
4.3 (medium)
Published
2024-10-21
Title
WP ERP < 1.13.3 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.13.3
CVSS
6.1 (medium)
Published
2024-07-10
Title
WP ERP < 1.13.1 - Authenticated (Accounting Manager+) SQL Injection via vendor_id
Fixed in
Fixed in 1.13.1
CVSS
8.8 (high)
Published
2024-05-01
Title
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting < 1.13.2 - Authenticated (AccountingManager+) SQL Injection
Fixed in
Fixed in 1.13.2
CVSS
7.2 (high)
Published
2024-03-28
Title
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.12.9 - Authenticated (Subscriber+) SQL Injection
Fixed in
No known fix
CVSS
8.8 (high)
Published
2024-03-28
Title
WP ERP <= 1.12.9 - Authenticated (AccountingManager+) SQL Injection
Fixed in
No known fix
CVSS
7.2 (high)
Published
2024-03-28
Title
WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection
Fixed in
No known fix
CVSS
7.2 (high)
Published
2024-03-28
Title
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.12.9 - Unauthenticated Stored Cross-Site Scripting
Fixed in
No known fix
CVSS
7.2 (high)
Published
2024-03-28
Title
WP ERP < 1.30.0 - Authenticated (Accounting Manager+) SQL Injection via id
Fixed in
Fixed in 1.30.0
CVSS
7.2 (high)
Published
2024-01-05
Title
WP ERP < 1.12.9 - Authenticated (Accounting manager+) SQL Injection
Fixed in
Fixed in 1.12.9
CVSS
7.2 (high)
Published
2023-10-12
Title
WP ERP < 1.12.7 - Missing Authorization via admin notice dismissal
Fixed in
Fixed in 1.12.7
CVSS
4.3 (medium)
Published
2023-06-05
Title
WP ERP < 1.12.4 - Admin+ SQL Injection
Fixed in
Fixed in 1.12.4
CVSS
4.1 (medium)
Published
2023-06-05
Title
WP ERP < 1.12.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.12.4
CVSS
7.1 (high)
Published
2021-03-01
Title
Multiple Plugins - CSRF Nonce Bypasses
Fixed in
Fixed in 1.7.5
CVSS
5.4 (medium)
Published
2020-09-26
Title
WP ERP < 1.6.4 - Cross-Site Request Forgery
Fixed in
Fixed in 1.6.4
CVSS
4.3 (medium)
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 1.6.4
CVSS
5.4 (medium)