Wpdirectorykit
Wpdirectorykit WP Directory KIT: vulnerabilidades y CVE
Wpdirectorykit WP Directory KIT tiene 39 vulnerabilidades publicadas, 26 de ellas en los últimos 12 meses. 7 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE39
Últimos 12 meses26
Críticas7
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-16596 | Media (6.5) | 0.22% | — | 30 sept 2026 | The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied… |
| CVE-2026-16591 | Alta (7.2) | 0.30% | — | 26 sept 2026 | The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin… |
| CVE-2026-16588 | Media (6.5) | 0.29% | — | 16 sept 2026 | The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and… |
| CVE-2026-18232 | Media (5.3) | 0.21% | — | 15 sept 2026 | The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read… |
| CVE-2026-16593 | Media (6.8) | 0.22% | — | 15 sept 2026 | The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above)… |
| CVE-2026-16592 | Baja (2.7) | 0.18% | — | 15 sept 2026 | The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content,… |
| CVE-2026-18231 | Media (5.3) | 0.34% | — | 19 ago 2026 | The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the… |
| CVE-2026-18653 | Alta (7.2) | 0.45% | — | 16 ago 2026 | The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this… |
| CVE-2026-28001 | Crítica (9.3) | 0.40% | — | 13 ago 2026 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. |
| CVE-2026-27538 | Alta (7.5) | 0.32% | — | 13 ago 2026 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. |
| CVE-2026-18474 | Alta (8.6) | 0.45% | — | 12 ago 2026 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search… |
| CVE-2026-18230 | Alta (8.1) | 0.39% | — | 12 ago 2026 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing… |
| CVE-2026-18473 | Crítica (9.1) | 0.46% | — | 9 ago 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. |
| CVE-2026-16595 | Media (6.5) | 0.37% | — | 8 ago 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's… |
| CVE-2026-16594 | Alta (7.5) | 0.42% | — | 8 ago 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP… |
| CVE-2026-16590 | Media (6.5) | 0.37% | — | 8 ago 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact… |
| CVE-2026-16589 | Alta (7.7) | 0.36% | — | 8 ago 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks,… |
| CVE-2026-39534 | Alta (7.5) | 0.39% | — | 15 jun 2026 | Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions. |
| CVE-2026-42672 | Crítica (9.3) | 0.40% | — | 1 jun 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through… |
| CVE-2026-39531 | Crítica (9.3) | 0.40% | — | 21 may 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through… |
| CVE-2025-13920 | Media (5.3) | 0.73% | — | 24 ene 2026 | The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the wdk_public_action AJAX handler. This makes it possible for unauthenticated… |
| CVE-2025-13089 | Alta (7.5) | 0.36% | — | 13 dic 2025 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user… |
| CVE-2025-13390 | Crítica (9.8) | 4.6% | — | 3 dic 2025 | The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the… |
| CVE-2025-13090 | Media (4.9) | 0.31% | — | 2 dic 2025 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of… |
| CVE-2025-13525 | Media (6.1) | 0.26% | — | 27 nov 2025 | The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output… |
| CVE-2025-13138 | Alta (7.5) | 1.5% | — | 21 nov 2025 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the… |
| CVE-2025-60120 | Media (5.3) | 0.29% | — | 26 sept 2025 | Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <=… |
| CVE-2023-41875 | Crítica (9.8) | 0.79% | — | 13 dic 2024 | Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6. |
| CVE-2024-37487 | Media (6.1) | 0.33% | — | 21 jul 2024 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpdirectorykit.Com WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through… |
| CVE-2024-37253 | Baja (2.7) | 0.32% | — | 9 jul 2024 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.