https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-2541.htmlhttps://patchthecve.com/cve/CVE-2025-2541.htmlWed, 17 Jun 2026 09:07:08 +0000MEDIUM 6.4: The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and abovhttps://patchthecve.com/cve/CVE-2025-3100.htmlhttps://patchthecve.com/cve/CVE-2025-3100.htmlWed, 17 Jun 2026 09:19:11 +0000MEDIUM 6.4: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping inhttps://patchthecve.com/cve/CVE-2025-32280.htmlhttps://patchthecve.com/cve/CVE-2025-32280.htmlWed, 17 Jun 2026 09:11:44 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager wedevs-project-manager allows Cross Site Request Forgery.This issue affects WP Project Manager: from n/a through < 2.6.25.https://patchthecve.com/cve/CVE-2025-22649.htmlhttps://patchthecve.com/cve/CVE-2025-22649.htmlWed, 17 Jun 2026 08:48:58 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager wedevs-project-manager allows Stored XSS.This issue affects WP Project Manager: from n/a through <= 2.6.22.https://patchthecve.com/cve/CVE-2024-13500.htmlhttps://patchthecve.com/cve/CVE-2024-13500.htmlWed, 17 Jun 2026 07:02:08 +0000MEDIUM 6.5: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied paramethttps://patchthecve.com/cve/CVE-2024-13752.htmlhttps://patchthecve.com/cve/CVE-2024-13752.htmlWed, 17 Jun 2026 07:02:40 +0000MEDIUM 6.5: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes https://patchthecve.com/cve/CVE-2024-12195.htmlhttps://patchthecve.com/cve/CVE-2024-12195.htmlWed, 17 Jun 2026 06:59:13 +0000MEDIUM 6.5: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 duehttps://patchthecve.com/cve/CVE-2024-10548.htmlhttps://patchthecve.com/cve/CVE-2024-10548.htmlWed, 17 Jun 2026 06:55:54 +0000MEDIUM 6.5: The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task List ('/wp-json/pm/v2/projects/1/task-lists') REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level acchttps://patchthecve.com/cve/CVE-2023-40003.htmlhttps://patchthecve.com/cve/CVE-2023-40003.htmlWed, 17 Jun 2026 06:15:41 +0000MEDIUM 6.5: Missing Authorization vulnerability in weDevs WP Project Manager wedevs-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Project Manager: from n/a through <= 2.6.7.https://patchthecve.com/cve/CVE-2024-10520.htmlhttps://patchthecve.com/cve/CVE-2024-10520.htmlWed, 17 Jun 2026 06:55:51 +0000MEDIUM 5.3: The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'Create_Milestone', 'Create_Task_List', 'Create_Task', and 'Delete_Task' classes in version 2.6.14. This makes it possible for unauthenticatedhttps://patchthecve.com/cve/CVE-2024-10174.htmlhttps://patchthecve.com/cve/CVE-2024-10174.htmlWed, 17 Jun 2026 06:55:05 +0000HIGH 7.3: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'Abstract_Permission' class due to missing validation on the 'user_id