Taskbuilder – Project Management & Task Management Tool With Kanban Board

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Taskbuilder – Project Management & Task Management Tool With Kanban Board

Information

Software Type Plugin
Software Slug taskbuilder (view on wordpress.org)
Software Status Active
Software Author taskbuilder
Software Website taskbuilder.net
Software Downloads 40,839
Software Active Installs 800
Software Record Last Updated July 18, 2026

15 Vulnerabilities

Submit a Vulnerability
Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter
6.5
CVE-2026-12110
Jun 30, 2026
Researcher: d.v4n_s3c
Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter
6.5
CVE-2026-12090
Jun 30, 2026
Researcher: Catalin Oancea (0x4D5A)
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.7 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-52697
Jun 10, 2026
Researcher: VanTastic
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter
6.5
CVE-2026-6225
May 13, 2026
Researcher: Louis Deschanel (JeanJeanLeHaxor)
Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field
4.4
CVE-2026-2289
Mar 3, 2026
Researcher: Phap Nguyen Anh
Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation
4.3
CVE-2026-1640
Feb 17, 2026
Researcher: Tarcísio Luchesi De Almeida Silva (Poystick)
Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters
6.5
CVE-2026-1639
Feb 17, 2026
Researcher: Tarcísio Luchesi De Almeida Silva (Poystick)
Taskbuilder <= 4.0.9 - Reflected Cross-Site Scripting
6.1
CVE-2025-67933
Jan 6, 2026
Researcher: Skalucy
Taskbuilder <= 4.0.7 - Missing Authorization
5.3
CVE-2025-30945
Jun 5, 2025
Researcher: Hiro
Taskbuilder <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-39569
Apr 17, 2025
Researcher: astra.r3verii
Taskbuilder <= 3.0.8 - Authenticated (Admin+) SQL Injection
4.9
CVE-2024-9831
Mar 3, 2025
Researcher: Bob Matyas
Taskbuilder <= 3.0.6 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-22716
Jan 15, 2025
Researcher: LVT-tholv2k
Taskbuilder – WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode
6.4
CVE-2024-11930
Jan 3, 2025
Researcher: Peter Thaleikis
Taskbuilder – WordPress Project & Task Management plugin <= 3.0.4 - Authenticated (Admin+) SQL injection
4.9
CVE-2024-9828
Oct 31, 2024
Researcher: Ryoma Yamada
Taskbuilder <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2022-3137
Sep 15, 2022
Researcher: Rizacan Tufan
Title Status CVE ID CVSS Researchers Date
Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter Patched CVE-2026-12110 6.5 d.v4n_s3c June 30, 2026
Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter Patched CVE-2026-12090 6.5 Catalin Oancea (0x4D5A) June 30, 2026
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.7 - Authenticated (Subscriber+) SQL Injection Patched CVE-2026-52697 6.5 VanTastic June 10, 2026
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter Patched CVE-2026-6225 6.5 Louis Deschanel (JeanJeanLeHaxor) May 13, 2026
Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field Patched CVE-2026-2289 4.4 Phap Nguyen Anh March 3, 2026
Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation Patched CVE-2026-1640 4.3 Tarcísio Luchesi De Almeida Silva (Poystick) February 17, 2026
Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters Patched CVE-2026-1639 6.5 Tarcísio Luchesi De Almeida Silva (Poystick) February 17, 2026
Taskbuilder <= 4.0.9 - Reflected Cross-Site Scripting Patched CVE-2025-67933 6.1 Skalucy January 6, 2026
Taskbuilder <= 4.0.7 - Missing Authorization Patched CVE-2025-30945 5.3 Hiro June 5, 2025
Taskbuilder <= 4.0.1 - Authenticated (Subscriber+) SQL Injection Patched CVE-2025-39569 6.5 astra.r3verii April 17, 2025
Taskbuilder <= 3.0.8 - Authenticated (Admin+) SQL Injection Patched CVE-2024-9831 4.9 Bob Matyas March 3, 2025
Taskbuilder <= 3.0.6 - Authenticated (Subscriber+) SQL Injection Patched CVE-2025-22716 6.5 LVT-tholv2k January 15, 2025
Taskbuilder – WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode Patched CVE-2024-11930 6.4 Peter Thaleikis January 3, 2025
Taskbuilder – WordPress Project & Task Management plugin <= 3.0.4 - Authenticated (Admin+) SQL injection Patched CVE-2024-9828 4.9 Ryoma Yamada October 31, 2024
Taskbuilder <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2022-3137 6.4 Rizacan Tufan September 15, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation