VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce security & vulnerabilities

erp— active installsLast vulnerability Nov 4, 2026

No known unpatched vulnerabilities in the latest version

All 31 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
31Known vulnerabilities
  • Critical1
  • High9
  • Medium21
  • Low0
Vulnerabilities per year
2020: 1 vulnerability1202022: 1 vulnerability1222023: 4 vulnerabilities4232024: 9 vulnerabilities9242025: 5 vulnerabilities5252026: 11 vulnerabilities1126

All ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce vulnerabilities

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.3Missing Authorization
<1.17.11Update to 1.17.11
CVE-2026-105191
High7.2Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
≤1.17.10Update to 1.17.11
CVE-2026-96894
Medium4.3Missing Authorization
≤1.17.10Update to 1.17.11
CVE-2026-25448
High7.5Authenticated (Custom Role+) PHP Object Injection
≤1.17.9Update to 1.17.10
CVE-2026-96343
Medium6.5Authenticated (Author+) SQL Injection
≤1.17.9Update to 1.17.10
CVE-2026-96346
Critical9.8Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
≤1.17.8Update to 1.17.9
CVE-2026-18080
Medium6.5Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter
≤1.17.4Update to 1.17.5
CVE-2026-11421
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler
≤1.17.6Update to 1.17.7
CVE-2026-15349
Medium4.3Missing Authorization
≤1.17.5Update to 1.17.6
CVE-2026-59522
Medium6.5Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter
≤1.17.5Update to 1.17.6
CVE-2026-13011
Medium6.5Authenticated (Crm agent+) SQL Injection
≤1.16.10Update to 1.16.11
CVE-2026-31917
Medium5.3Missing Authorization
≤1.16.7Update to 1.16.8
CVE-2025-63008
Medium4.3Authenticated (Subscriber+) Information Exposure
≤1.16.6Update to 1.16.7
CVE-2025-67546
Medium4.3Missing Authorization
≤1.13.4Update to 1.14.0
CVE-2025-30896
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.13.3Update to 1.13.4
CVE-2024-12808
Medium4.3Authenticated (Employee+) Insecure Direct Object Reference
≤1.13.3Update to 1.13.4
CVE-2024-12812
Medium6.1Reflected Cross-Site Scripting
≤1.13.2Update to 1.13.3
CVE-2024-47640
High8.8Authenticated (Accounting Manager+) SQL Injection via vendor_id
≤1.13.0Update to 1.13.1
CVE-2024-6666
High7.2Authenticated (AccountingManager+) SQL Injection
≤1.13.1Update to 1.13.2
CVE-2024-1173
High7.2Authenticated (Accounting Manager+) SQL Injection via id
≤1.12.9Update to 1.13.0
CVE-2024-0952
High7.2Authenticated (Accounting Manager+) SQL Injection
≤1.13.0Update to 1.13.1
CVE-2024-0913
Medium6.5Authenticated (Subscriber+) SQL Injection
≤1.13.1Update to 1.13.2
CVE-2024-0608
High7.2Unauthenticated Stored Cross-Site Scripting
≤1.13.1Update to 1.13.2
CVE-2024-0609
Medium4.9Authenticated (AccountingManager+) SQL Injection
≤1.13.0Update to 1.13.1
CVE-2024-0956
High7.2Authenticated (Accounting manager+) SQL Injection
≤1.12.8Update to 1.12.9
CVE-2024-21747
Medium4.3Missing Authorization via admin notice dismissal
≤1.12.6Update to 1.12.7
CVE-2023-45765
High7.2Authenticated (Administrator+) SQL Injection via 'type'
<1.12.4Update to 1.12.4
CVE-2023-2744
Medium6.1Reflected Cross-Site Scripting
<1.12.4Update to 1.12.4
CVE-2023-2743
Medium6.1Reflected Cross-Site Scripting
≤1.12.3Update to 1.12.4
CVE-2023-34008
Medium6.3Sensitive Data Exposure
≤1.10.5Update to 1.10.6
—
Medium4.3Cross-Site Request Forgery Bypass
<1.6.4Update to 1.6.4
CVE-2020-36735

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: common questions

Does ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce have known vulnerabilities?

Yes. VulnCrest Radar lists 31 known vulnerabilities in ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: 1 critical, 9 high, 21 medium. None are known to affect version null.

How do I check which version of ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce vulnerability?

CVE-2026-105191, published Nov 4, 2026: ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce < 1.17.11 - Missing Authorization. Severity: Medium (CVSS 4.3).

Is any ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce vulnerability listed in CISA KEV?

No. None of the known ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?