What’s Vulnerable › Products
wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads vulnerabilities
22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.
Latest wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads vulnerabilities
- CVE-2026-100185 — Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field (CVSS 6.4)
- CVE-2026-17092 — Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter (CVSS 8.1)
- CVE-2026-59518 — WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability (CVSS 9.8)
- CVE-2026-39509 — WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2025-68069 — WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability (CVSS 7.1)
- CVE-2025-64250 — WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability (CVSS 4.7)
- CVE-2025-12174 — Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update (CVSS 6.5)
- CVE-2025-10488 — Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move (CVSS 8.1)
- CVE-2025-2224 — Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing (CVSS 5.3)
- CVE-2025-1570 — Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP (CVSS 9.8)
- CVE-2024-12041 — Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure (CVSS 5.3)
- CVE-2024-1322 — Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change (CVSS 5.3)
- CVE-2023-2252 — Directorist < 7.5.4 - Admin+ LFI (CVSS 2.7)
- CVE-2023-41798 — WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection (CVSS 8.8)
- CVE-2023-1889 — Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task (CVSS 6.5)
- CVE-2023-1888 — Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation (CVSS 8.8)
- CVE-2022-3961 — Directorist < 7.4.4 - Subscriber+ Sensitive Information Disclosure (CVSS 6.5)
- CVE-2022-3930 — Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR (CVSS 6.5)
- CVE-2022-2376 — Directorist < 7.3.1 - Unauthenticated Email Address Disclosure (CVSS 5.3)
- CVE-2022-2377 — Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending (CVSS 4.3)
- CVE-2022-2046 — Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload (CVSS 4.9)
- CVE-2021-24981 — Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload (CVSS 7.5)