Wpdirectorykit
Wpdirectorykit WP Directory KIT: vulnerabilities and CVEs
Wpdirectorykit WP Directory KIT has 39 published vulnerabilities, 26 of them in the last 12 months. 7 are rated critical and 0 are listed by CISA as actively exploited.
CVEs39
Last 12 months26
Critical7
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-16596 | Medium (6.5) | 0.22% | — | Sep 30, 2026 | The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied… |
| CVE-2026-16591 | High (7.2) | 0.30% | — | Sep 26, 2026 | The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin… |
| CVE-2026-16588 | Medium (6.5) | 0.29% | — | Sep 16, 2026 | The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and… |
| CVE-2026-18232 | Medium (5.3) | 0.21% | — | Sep 15, 2026 | The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read… |
| CVE-2026-16593 | Medium (6.8) | 0.22% | — | Sep 15, 2026 | The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above)… |
| CVE-2026-16592 | Low (2.7) | 0.18% | — | Sep 15, 2026 | The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content,… |
| CVE-2026-18231 | Medium (5.3) | 0.34% | — | Aug 19, 2026 | The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the… |
| CVE-2026-18653 | High (7.2) | 0.45% | — | Aug 16, 2026 | The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this… |
| CVE-2026-28001 | Critical (9.3) | 0.40% | — | Aug 13, 2026 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. |
| CVE-2026-27538 | High (7.5) | 0.32% | — | Aug 13, 2026 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. |
| CVE-2026-18474 | High (8.6) | 0.45% | — | Aug 12, 2026 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search… |
| CVE-2026-18230 | High (8.1) | 0.39% | — | Aug 12, 2026 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing… |
| CVE-2026-18473 | Critical (9.1) | 0.46% | — | Aug 9, 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. |
| CVE-2026-16595 | Medium (6.5) | 0.37% | — | Aug 8, 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's… |
| CVE-2026-16594 | High (7.5) | 0.42% | — | Aug 8, 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP… |
| CVE-2026-16590 | Medium (6.5) | 0.37% | — | Aug 8, 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact… |
| CVE-2026-16589 | High (7.7) | 0.36% | — | Aug 8, 2026 | The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks,… |
| CVE-2026-39534 | High (7.5) | 0.39% | — | Jun 15, 2026 | Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions. |
| CVE-2026-42672 | Critical (9.3) | 0.40% | — | Jun 1, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through… |
| CVE-2026-39531 | Critical (9.3) | 0.40% | — | May 21, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through… |
| CVE-2025-13920 | Medium (5.3) | 0.73% | — | Jan 24, 2026 | The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the wdk_public_action AJAX handler. This makes it possible for unauthenticated… |
| CVE-2025-13089 | High (7.5) | 0.36% | — | Dec 13, 2025 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user… |
| CVE-2025-13390 | Critical (9.8) | 4.6% | — | Dec 3, 2025 | The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the… |
| CVE-2025-13090 | Medium (4.9) | 0.31% | — | Dec 2, 2025 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of… |
| CVE-2025-13525 | Medium (6.1) | 0.26% | — | Nov 27, 2025 | The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output… |
| CVE-2025-13138 | High (7.5) | 1.5% | — | Nov 21, 2025 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the… |
| CVE-2025-60120 | Medium (5.3) | 0.29% | — | Sep 26, 2025 | Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <=… |
| CVE-2023-41875 | Critical (9.8) | 0.79% | — | Dec 13, 2024 | Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6. |
| CVE-2024-37487 | Medium (6.1) | 0.33% | — | Jul 21, 2024 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpdirectorykit.Com WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through… |
| CVE-2024-37253 | Low (2.7) | 0.32% | — | Jul 9, 2024 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.