Plugin icon

WP Directory Kit

wpdirectorykit

Vulnerabilities:

21

Last Updated:

April 23, 2026

Active Installs:

3000

Published
Title
Fixed in
CVSS
Published
2026-05-14
Title
WP Directory Kit < 1.5.2 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.5.2
CVSS
7.5 (high)
Published
2026-04-13
Title
WP Directory Kit < 1.5.1 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.5.1
CVSS
7.5 (high)
Published
2026-04-08
Title
WP Directory Kit < 1.5.1 - Missing Authorization
Fixed in
Fixed in 1.5.1
CVSS
5.3 (medium)
Published
2026-01-23
Title
WP Directory Kit < 1.5.0 - Unauthenticated Email Exposure via wdk_public_action
Fixed in
Fixed in 1.5.0
CVSS
5.3 (medium)
Published
2025-12-12
Title
WP Directory Kit < 1.4.8 - Unauthenticated SQL Injection
Fixed in
Fixed in 1.4.8
CVSS
7.5 (high)
Published
2025-12-03
Title
WP Directory Kit < 1.4.5 - Privilege Escalation via Account Takeover
Fixed in
Fixed in 1.4.5
CVSS
10.0 (critical)
Published
2025-12-01
Title
WP Directory Kit < 1.4.7 - Authenticated (Admin+) SQL Injection
Fixed in
Fixed in 1.4.7
CVSS
4.9 (medium)
Published
2025-11-26
Title
WP Directory Kit < 1.4.6 - Reflected Cross-Site Scripting via 'order_by' Parameter
Fixed in
Fixed in 1.4.6
CVSS
6.1 (medium)
Published
2025-11-20
Title
WP Directory Kit < 1.4.4 - Unauthenticated SQL Injection via select_2_ajax() Function
Fixed in
Fixed in 1.4.4
CVSS
7.5 (high)
Published
2025-09-26
Title
WP Directory Kit < 1.4.1 - Missing Authorization
Fixed in
Fixed in 1.4.1
CVSS
5.3 (medium)
Published
2024-07-04
Title
WP Directory Kit < 1.3.6 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.3.6
CVSS
6.1 (medium)
Published
2024-04-04
Title
WP Directory Kit < 1.3.1 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 1.3.1
CVSS
8.8 (high)
Published
2024-03-25
Title
WP Directory Kit < 1.3.0 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.3.0
CVSS
6.1 (medium)
Published
2023-09-05
Title
WP Directory Kit < 1.2.7 - Missing Authorization
Fixed in
Fixed in 1.2.7
CVSS
5.3 (medium)
Published
2023-06-12
Title
WP Directory Kit < 1.2.4 - Missing Authorization for Plugin Settings Update
Fixed in
Fixed in 1.2.4
CVSS
6.5 (medium)
Published
2023-06-01
Title
WP Directory Kit < 1.2.4 - Reflected Cross-Site Scripting via search parameter
Fixed in
Fixed in 1.2.4
CVSS
6.1 (medium)
Published
2023-05-26
Title
WP Directory Kit < 1.2.0 - Unauthenticated Local File Inclusion
Fixed in
Fixed in 1.2.0
CVSS
8.2 (high)
Published
2023-05-02
Title
WP Directory Kit < 1.2.3 - Unauthenticated Arbitrary Settings Update
Fixed in
Fixed in 1.2.3
CVSS
6.5 (medium)
Published
2023-04-28
Title
WP Directory Kit < 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update
Fixed in
Fixed in 1.2.2
CVSS
5.4 (medium)
Published
2023-04-28
Title
WP Directory Kit < 1.2.0 - Cross-Site Request Forgery
Fixed in
Fixed in 1.2.0
CVSS
5.4 (medium)
Published
2023-04-27
Title
WP Directory Kit < 1.2.0 - Open Redirect
Fixed in
Fixed in 1.2.0
CVSS
5.4 (medium)