Medium
CVE-2026-97281
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 29
Reset filters
Medium
CVE-2026-74930
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.2.0 - 4.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-74929
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker < 4.0.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-78262
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.6 - Unauthenticated PHP Object Injection
Medium
CVE-2026-74928
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation
Medium
CVE-2026-32478
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-78470
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-68040
Project Manager <= 3.0.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-8994
WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'
Medium
CVE-2025-58269
WP Project Manager <= 2.6.25 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-2541
WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2025-3100
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2025-32280
WP Project Manager <= 2.6.24 - Cross-Site Request Forgery
Medium
CVE-2024-13500
WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
Medium
CVE-2024-13752
WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
Medium
CVE-2025-22649
WP Project Manager <= 2.6.22 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-12195
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-10548
WP Project Manager <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API
Medium
CVE-2024-12015
WP Project Manager <= 2.6.31 - Authenticated (Project Manager+) SQL Injection
Medium
CVE-2024-10520
WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion
High
CVE-2024-10174
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass
Medium
CVE-2023-40003
WP Project Manager <= 2.6.7 - Missing Authorization
Medium
CVE-2023-49860
WP Project Manager <= 2.6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2023-34383
WP Project Manager <= 2.6.0 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.