WordPress plugin
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High4
- Medium23
- Low0
All Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker vulnerabilities
- Critical9.8Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
≤4.1.1Update to 4.1.2
- Medium4.3Missing Authorization
≤4.0.7Update to 4.1.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
<4.0.7Update to 4.0.7
- Medium4.34.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
2.2.0 – 4.0.6Update to 4.0.7
- High8.1Unauthenticated PHP Object Injection
≤4.0.6Update to 4.0.7
- Medium5.34.0.6 - Unauthenticated Subscriber Account Creation
2.1.0 – 4.0.6Update to 4.0.7
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤3.0.1Update to 3.0.2
- Medium6.5Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'
≤2.6.26Update to 2.6.27
- Medium5.3Unauthenticated Sensitive Information Exposure
≤2.6.25Update to 2.6.26
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
≤2.6.22Update to 2.6.23
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
≤2.6.22Update to 2.6.23
- Medium4.3Cross-Site Request Forgery
≤2.6.24Update to 2.6.25
- Medium6.5Authenticated (Subscriber+) SQL Injection via orderby Parameter
≤2.6.17Update to 2.6.18
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
≤2.6.17Update to 2.6.18
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.6.22Update to 2.6.23
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤2.6.16Update to 2.6.17
- Medium6.5Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API
≤2.6.15Update to 2.6.16
- Medium6.5Authenticated (Project Manager+) SQL Injection
≤2.6.31Update to 3.0.0
- Medium5.3Missing Authorization to Project Milestone and Task Creation/Deletion
≤2.6.14Update to 2.6.15
- High7.3Insecure Direct Object Reference to Unauthenticated Authorization Bypass
≤2.6.13Update to 2.6.14
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.6.8Update to 2.6.9
- Medium5.3Missing Authorization
≤2.6.7Update to 2.6.8
- High8.8Authenticated (Subscriber+) SQL Injection
≤2.6.0Update to 2.6.1
- High8.8Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
≤2.6.4Update to 2.6.5
- Medium4.3Missing Authorization
≤3.6.0Update to 3.6.1
- Medium4.3Cross-Site Request Forgery
≤3.6.0Update to 3.6.1
- Medium5.4Authenticated Stored Cross-Site Scripting
≤2.4.13Update to 2.4.14
- Medium4.3Cross-Site Request Forgery Bypass
<2.4.1Update to 2.4.1
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker: common questions
Does Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker have known vulnerabilities?
Yes. VulnCrest Radar lists 28 known vulnerabilities in Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker: 1 critical, 4 high, 23 medium. At least one is not fixed in the latest version.
How do I check which version of Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker vulnerability?
CVE-2026-116512, published Oct 30, 2026: Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection. Severity: Critical (CVSS 9.8).
Is any Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker vulnerability listed in CISA KEV?
No. None of the known Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker vulnerabilities is currently listed in the CISA KEV catalog.