Advisories · Technology

Directorist: AI-Powered Business Directory, Listings & Classified Ads.

Every CVE that names Directorist: AI-Powered Business Directory, Listings & Classified Ads among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-118534 CVE record

Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
Not analysed yet 7 Nov 2026
CVE-2026-118533 CVE record

Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
Not analysed yet 7 Nov 2026
CVE-2026-118532 CVE record

Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
Not analysed yet 7 Nov 2026
CVE-2026-118530 CVE record

Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
Not analysed yet 7 Nov 2026
CVE-2026-118529 CVE record

Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
Not analysed yet 7 Nov 2026
CVE-2026-118528 CVE record

Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
Not analysed yet 7 Nov 2026
CVE-2026-84150 CVE record

CVSS 5.4 Medium

Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Broken access control
Not analysed yet 23 Sept 2026
CVE-2026-84098 CVE record

CVSS 6.5 Medium

Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Broken access control
Not analysed yet 23 Sept 2026
CVE-2026-84046 CVE record

CVSS 5.0 Medium

Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Server-side request forgery (SSRF)
Not analysed yet 23 Sept 2026
CVE-2026-84027 CVE record

CVSS 4.3 Medium

Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Broken access control
Not analysed yet 23 Sept 2026
CVE-2026-84026 CVE record

CVSS 5.3 Medium

Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Information disclosure
Not analysed yet 23 Sept 2026
CVE-2026-77766 CVE record

CVSS 4.3 Medium

Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Broken access control
Not analysed yet 23 Sept 2026
CVE-2026-84066 CVE record

CVSS 3.1 Low

Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Broken access control
Not analysed yet 4 Sept 2026
CVE-2026-77757 CVE record

CVSS 5.4 Medium

Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Path traversal
Not analysed yet 26 Aug 2026