Plugin icon

WP Directory Kit

wpdirectorykit

Vulnerabilities:

39

Last Updated:

October 4, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-10-09
Title
WP Directory Kit < 1.6.0 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
Fixed in
Fixed in 1.6.0
CVSS
6.5 (medium)
Published
2026-09-29
Title
WP Directory Kit < 1.5.5 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
Fixed in
Fixed in 1.5.5
CVSS
6.5 (medium)
Published
2026-09-24
Title
WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields
Fixed in
Fixed in 1.5.8
CVSS
7.2 (high)
Published
2026-09-15
Title
WP Directory Kit < 1.5.5 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter
Fixed in
Fixed in 1.5.5
CVSS
6.5 (medium)
Published
2026-09-12
Title
WP Directory Kit <= 1.5.9 - Unauthenticated Unpublished Listing Disclosure via search_suggestion
Fixed in
No known fix
CVSS
5.3 (medium)
Published
2026-09-12
Title
WP Directory Kit <= 1.5.9 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes
Fixed in
No known fix
CVSS
3.1 (low)
Published
2026-09-12
Title
WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings
Fixed in
No known fix
CVSS
6.8 (medium)
Published
2026-08-17
Title
WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user
Fixed in
Fixed in 1.5.7
CVSS
5.3 (medium)
Published
2026-08-14
Title
WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter
Fixed in
Fixed in 1.5.7
CVSS
4.9 (medium)
Published
2026-08-12
Title
Directory Kit < 1.5.5 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.5.5
CVSS
7.5 (high)
Published
2026-08-11
Title
WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.5.5
CVSS
5.9 (medium)
Published
2026-08-10
Title
WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter
Fixed in
Fixed in 1.5.6
CVSS
7.7 (high)
Published
2026-08-10
Title
WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category
Fixed in
Fixed in 1.5.6
CVSS
8.6 (high)
Published
2026-08-03
Title
WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
Fixed in
Fixed in 1.5.5
CVSS
6.5 (medium)
Published
2026-08-03
Title
WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter
Fixed in
Fixed in 1.5.5
CVSS
8.6 (high)
Published
2026-08-03
Title
WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
Fixed in
Fixed in 1.5.5
CVSS
4.3 (medium)
Published
2026-08-03
Title
WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
Fixed in
Fixed in 1.5.5
CVSS
4.3 (medium)
Published
2026-08-03
Title
WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
Fixed in
Fixed in 1.5.5
CVSS
7.7 (high)
Published
2026-05-14
Title
WP Directory Kit < 1.5.2 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.5.2
CVSS
7.5 (high)
Published
2026-04-13
Title
WP Directory Kit < 1.5.1 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.5.1
CVSS
7.5 (high)
Published
2026-04-08
Title
WP Directory Kit < 1.5.1 - Missing Authorization
Fixed in
Fixed in 1.5.1
CVSS
5.3 (medium)
Published
2026-01-23
Title
WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure via wdk_public_action
Fixed in
Fixed in 1.5.0
CVSS
5.3 (medium)
Published
2025-12-12
Title
WP Directory Kit < 1.4.8 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.4.8
CVSS
7.5 (high)
Published
2025-12-03
Title
WP Directory Kit < 1.4.5 - Privilege Escalation via Account Takeover
Fixed in
Fixed in 1.4.5
CVSS
10.0 (critical)
Published
2025-12-01
Title
WP Directory Kit < 1.4.7 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 1.4.7
CVSS
4.9 (medium)
Published
2025-11-26
Title
WP Directory Kit < 1.4.6 - Reflected Cross-Site Scripting via 'order_by' Parameter
Fixed in
Fixed in 1.4.6
CVSS
6.1 (medium)
Published
2025-11-20
Title
WP Directory Kit < 1.4.4 - Unauthenticated SQL Injection via select_2_ajax() Function
Fixed in
Fixed in 1.4.4
CVSS
7.5 (high)
Published
2025-09-26
Title
WP Directory Kit < 1.4.1 - Missing Authorization
Fixed in
Fixed in 1.4.1
CVSS
5.3 (medium)
Published
2024-07-04
Title
WP Directory Kit < 1.3.6 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.3.6
CVSS
6.1 (medium)
Published
2024-04-04
Title
WP Directory Kit < 1.3.1 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 1.3.1
CVSS
8.8 (high)
Published
2024-03-25
Title
WP Directory Kit < 1.3.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.3.0
CVSS
6.1 (medium)
Published
2023-09-05
Title
WP Directory Kit < 1.2.7 - Missing Authorization
Fixed in
Fixed in 1.2.7
CVSS
5.3 (medium)
Published
2023-06-12
Title
WP Directory Kit < 1.2.4 - Missing Authorization for Plugin Settings Update
Fixed in
Fixed in 1.2.4
CVSS
6.5 (medium)
Published
2023-06-01
Title
WP Directory Kit < 1.2.4 - Reflected Cross-Site Scripting via search parameter
Fixed in
Fixed in 1.2.4
CVSS
6.1 (medium)
Published
2023-05-26
Title
WP Directory Kit < 1.2.0 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 1.2.0
CVSS
8.2 (high)
Published
2023-05-02
Title
WP Directory Kit < 1.2.3 - Unauthenticated Arbitrary Settings Update
Fixed in
Fixed in 1.2.3
CVSS
6.5 (medium)
Published
2023-04-28
Title
WP Directory Kit < 1.2.0 - Cross-Site Request Forgery
Fixed in
Fixed in 1.2.0
CVSS
5.4 (medium)
Published
2023-04-28
Title
WP Directory Kit < 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update
Fixed in
Fixed in 1.2.2
CVSS
5.4 (medium)
Published
2023-04-27
Title
WP Directory Kit < 1.2.0 - Open Redirect
Fixed in
Fixed in 1.2.0
CVSS
5.4 (medium)