Advisories · Technology
wpdirectorykit WP Directory Kit.
Every CVE that names wpdirectorykit WP Directory Kit among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 6.5 Medium
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 6.5 Medium
WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 6.5 Medium
WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
- WPDirectoryKit WP Directory Kit
- SQL injection
- CVSS 7.5 High
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
- WPDirectoryKit WP Directory Kit
- SQL injection
- CVSS 5.3 Medium
WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action
- wpdirectorykit WP Directory Kit
- Information disclosure
- CVSS 7.5 High
WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 4.9 Medium
WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 6.1 Medium
WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter
- wpdirectorykit WP Directory Kit
- Cross-site scripting (XSS)
- CVSS 7.5 High
WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 5.3 Medium
WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability
- WPDirectoryKit WP Directory Kit
- Broken access control
- CVSS 2.7 Low
WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability
- WpDirectoryKit WP Directory Kit
- Other injection
- CVSS 8.8 High
WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 7.1 High
WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
- WpDirectoryKit WP Directory Kit
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display
- wpdirectorykit WP Directory Kit
- Cross-site request forgery (CSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action
- wpdirectorykit WP Directory Kit
- Path traversal
- CVSS 6.1 Medium
WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem
- wpdirectorykit WP Directory Kit
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action
- wpdirectorykit WP Directory Kit
- Broken access control
- CVSS 6.5 Medium
WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action
- wpdirectorykit WP Directory Kit
- Broken access control
- CVSS 6.1 Medium
WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'
- wpdirectorykit WP Directory Kit
- Cross-site scripting (XSS)