What’s Vulnerable › Products
WP Directory Kit vulnerabilities
13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.
Check whether your WP Directory Kit version is affected
Latest WP Directory Kit vulnerabilities
- CVE-2026-16591 — WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields (CVSS 7.2)
- CVE-2026-18232 — WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow (CVSS 5.3)
- CVE-2026-16593 — WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings (CVSS 6.8)
- CVE-2026-16592 — WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes (CVSS 2.7)
- CVE-2026-18231 — WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user (CVSS 5.3)
- CVE-2026-18653 — WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter (CVSS 7.2)
- CVE-2026-18474 — WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category (CVSS 8.6)
- CVE-2026-18230 — WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter (CVSS 8.1)
- CVE-2026-18473 — WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter (CVSS 9.1)
- CVE-2026-16595 — WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure (CVSS 6.5)
- CVE-2026-16594 — WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure (CVSS 7.5)
- CVE-2026-16590 — WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure (CVSS 6.5)
- CVE-2026-16589 — WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter (CVSS 7.7)