Plugin icon

Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker

wedevs-project-manager

Vulnerabilities:

22

Last Updated:

March 4, 2026

Active Installs:

7000

Published
Title
Fixed in
CVSS
Published
2025-12-26
Title
Project Manager < 3.0.2 - Authenticated (Subscriber+) Information Exposure
Fixed in
Fixed in 3.0.2
CVSS
4.3 (medium)
Published
2025-11-14
Title
WP Project Manager < 2.6.27 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'
Fixed in
Fixed in 2.6.27
CVSS
6.5 (medium)
Published
2025-09-22
Title
WP Project Manager < 2.6.26 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 2.6.26
CVSS
5.3 (medium)
Published
2025-04-10
Title
WP Project Manager < 2.6.23 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Fixed in
Fixed in 2.6.23
CVSS
6.4 (medium)
Published
2025-04-08
Title
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts < 2.6.23 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
Fixed in
Fixed in 2.6.23
CVSS
6.4 (medium)
Published
2025-04-04
Title
WP Project Manager < 2.6.25 - Cross-Site Request Forgery
Fixed in
Fixed in 2.6.25
CVSS
4.3 (medium)
Published
2025-02-14
Title
WP Project Manager < 2.6.18 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
Fixed in
Fixed in 2.6.18
CVSS
6.5 (medium)
Published
2025-02-14
Title
WP Project Manager < 2.6.18 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
Fixed in
Fixed in 2.6.18
CVSS
6.5 (medium)
Published
2025-02-03
Title
WP Project Manager < 2.6.23 - Admin+ Stored XSS
Fixed in
Fixed in 2.6.23
CVSS
3.5 (low)
Published
2025-01-03
Title
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts < 2.6.17 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 2.6.17
CVSS
6.5 (medium)
Published
2024-12-18
Title
WP Project Manager < 2.6.16 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API
Fixed in
Fixed in 2.6.16
CVSS
6.5 (medium)
Published
2024-12-02
Title
WP Project Manager <= 2.6.26 - Project Manager+ SQL Injection
Fixed in
No known fix
CVSS
6.5 (medium)
Published
2024-11-19
Title
WP Project Manager < 2.6.15 - Missing Authorization to Project Milestone and Task Creation/Deletion
Fixed in
Fixed in 2.6.15
CVSS
5.3 (medium)
Published
2024-11-12
Title
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts < 2.6.14 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass
Fixed in
Fixed in 2.6.14
CVSS
7.3 (high)
Published
2023-12-07
Title
WP Project Manager < 2.6.8 - Missing Authorization
Fixed in
Fixed in 2.6.8
CVSS
5.3 (medium)
Published
2023-12-07
Title
WP Project Manager < 2.6.9 - Subscriber+ Stored XSS
Fixed in
Fixed in 2.6.9
CVSS
8.8 (high)
Published
2023-09-04
Title
WP Project Manager < 2.6.1 - Subscriber+ SQLi
Fixed in
Fixed in 2.6.1
CVSS
7.7 (high)
Published
2023-08-09
Title
WP Project Manager < 2.6.5 - Subscriber+ Privilege Escalation
Fixed in
Fixed in 2.6.5
CVSS
8.8 (high)
Published
2021-11-10
Title
WP Project Manager < 2.4.14 - Authenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.4.14
CVSS
5.4 (medium)
Published
2021-03-01
Title
Multiple Plugins - CSRF Nonce Bypasses
Fixed in
Fixed in 2.4.10
CVSS
5.4 (medium)
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 2.4.1
CVSS
5.4 (medium)
Published
2020-09-16
Title
WP Project Manager < 2.4.1 - Cross-Site Request Forgery
Fixed in
Fixed in 2.4.1
CVSS
4.3 (medium)