Advisories · Technology
WP Directory Kit.
Every CVE that names WP Directory Kit among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
-
WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'main_field' Parameter
- WP Directory Kit
-
WP Directory Kit < 1.6.3 - Unauthenticated User Data and Contact Message Disclosure
- WP Directory Kit
- CVSS 7.2 High
WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields
- WP Directory Kit
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow
- WP Directory Kit
- Information disclosure
- CVSS 2.7 Low
WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes
- WP Directory Kit
- Information disclosure
- CVSS 6.8 Medium
WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings
- WP Directory Kit
- SQL injection
- CVSS 5.3 Medium
WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user
- WP Directory Kit
- Information disclosure
- CVSS 7.2 High
WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter
- WP Directory Kit
- SQL injection
- CVSS 8.6 High
WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category
- WP Directory Kit
- SQL injection
- CVSS 8.1 High
WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter
- WP Directory Kit
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter
- WP Directory Kit
- SQL injection
- CVSS 6.5 Medium
WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
- WP Directory Kit
- Information disclosure
- CVSS 7.5 High
WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
- WP Directory Kit
- Information disclosure
- CVSS 6.5 Medium
WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
- WP Directory Kit
- Information disclosure
- CVSS 7.7 High
WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
- WP Directory Kit
- SQL injection
- CVSS 7.5 High
WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability
- WP Directory Kit
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability
- WP Directory Kit
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability
- WP Directory Kit
- SQL injection
- CVSS 4.7 Medium
WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection
- WP Directory Kit
- Open redirect