What’s Vulnerable › Products
wpdirectorykit WP Directory Kit vulnerabilities
27 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your wpdirectorykit WP Directory Kit version is affected
Latest wpdirectorykit WP Directory Kit vulnerabilities
- CVE-2026-96653 — WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order) (CVSS 6.5)
- CVE-2026-16596 — WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter (CVSS 6.5)
- CVE-2026-16588 — WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter (CVSS 6.5)
- CVE-2026-28001 — WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability (CVSS 9.3)
- CVE-2026-27538 — WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability (CVSS 7.5)
- CVE-2026-39534 — WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability (CVSS 7.5)
- CVE-2026-42672 — WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability (CVSS 9.3)
- CVE-2026-39531 — WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability (CVSS 9.3)
- CVE-2025-13920 — WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action (CVSS 5.3)
- CVE-2025-13089 — WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection (CVSS 7.5)
- CVE-2025-13390 — WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover (CVSS 9.8)
- CVE-2025-13090 — WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection (CVSS 4.9)
- CVE-2025-13525 — WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter (CVSS 6.1)
- CVE-2025-13138 — WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function (CVSS 7.5)
- CVE-2025-60120 — WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2023-41875 — WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability (CVSS 9.8)
- CVE-2024-37487 — WordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2024-37253 — WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability (CVSS 2.7)
- CVE-2024-3217 — WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8)
- CVE-2024-29774 — WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
- CVE-2023-31229 — WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection (CVSS 6.1)
- CVE-2023-2279 — WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display (CVSS 5.4)
- CVE-2023-2351 — WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action (CVSS 4.3)
- CVE-2023-2278 — WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action (CVSS 9.8)
- CVE-2023-2277 — WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem (CVSS 4.7)