Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-02
Project Manager - Security Vulnerability (CVE-2026-116512)
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated directly into the pipe-delimited validation rule string, which is then split and each token invoked as a dynamic PHP function with no allowlist check. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable by unauthenticated attackers because…
PLUGIN
Project Manager
CVE-2026-116512
Risk Score
Threat Entry
Updated 2026-08-26
Project Manager - Security Vulnerability (CVE-2026-74929)
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.
PLUGIN
Project Manager
CVE-2026-74929
Risk Score
Threat Entry
Updated 2026-08-26
Project Manager - Security Vulnerability (CVE-2026-74930)
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
PLUGIN
Project Manager
CVE-2026-74930
Risk Score
Threat Entry
Updated 2026-08-26
Project Manager - Security Vulnerability (CVE-2026-74928)
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.
PLUGIN
Project Manager
CVE-2026-74928
Risk Score
Threat Entry
Updated 2026-06-17
Project Manager - SQL Injection (CVE-2024-12015)
The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.
PLUGIN
Project Manager
CVE-2024-12015
Risk Score