Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

WP Directory Kit — Vulnerabilities & Security Advisories 31

All 31 CVE vulnerabilities found in WP Directory Kit, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known vulnerabilities associated with WP Directory Kit, a plugin developed by CodeLabPress for the WordPress ecosystem. It serves as a centralized resource for security professionals and site administrators to review past security issues related to this specific directory solution. The content compiled here encompasses various vulnerability types, including cross-site scripting, improper authorization, and information disclosure flaws. The data covers incidents reported and disclosed from the plugin’s initial release through recent security advisories, providing a comprehensive historical perspective on its security posture. By accessing this aggregation, users can effectively track vendor responses to reported bugs and understand the timeline of remediation efforts. Visitors can also gain a deeper understanding of specific weakness classes prevalent in WordPress plugins by examining how they manifested in this product. Additionally, the page allows for looking up the complete vulnerability history of WP Directory Kit, helping teams assess the long-term maintenance quality of the software. This structured overview supports risk assessment by highlighting patterns in reported issues and the effectiveness of vendor patches. It is designed to aid in compliance reviews and security audits by providing transparent access to all documented security defects without requiring searches across multiple external sources or individual vendor announcements.

Vendor: wpdirectorykit

CVE IDTitleCVSSSeverityPublished
CVE-2026-28001 WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability CWE-89 9.3 Critical2026-08-13
CVE-2026-27538 WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability CWE-89 7.5 High2026-08-13
CVE-2026-18474 WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category --2026-08-12
CVE-2026-18230 WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter --2026-08-12
CVE-2026-18473 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter --2026-08-09
CVE-2026-16595 WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure --2026-08-08
CVE-2026-16589 WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter --2026-08-08
CVE-2026-16590 WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure --2026-08-08
CVE-2026-16594 WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure --2026-08-08
CVE-2026-39534 WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability CWE-862 7.5 High2026-06-15
CVE-2026-42672 WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability CWE-89 9.3 Critical2026-06-01
CVE-2026-39531 WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability CWE-89 9.3 Critical2026-05-21
CVE-2025-13920 WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action CWE-200 5.3 Medium2026-01-24
CVE-2025-13089 WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection CWE-89 7.5 High2025-12-13
CVE-2025-13390 WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover CWE-303 10.0 Critical2025-12-03
CVE-2025-13090 WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection CWE-89 4.9 Medium2025-12-02
CVE-2025-13525 WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter CWE-79 6.1 Medium2025-11-27
CVE-2025-13138 WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function CWE-89 7.5 High2025-11-21
CVE-2025-60120 WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability CWE-862 5.3 Medium2025-09-26
CVE-2023-41875 WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability CWE-862 5.3 Medium2024-12-13
CVE-2024-37487 WordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High2024-07-21
CVE-2024-37253 WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability CWE-74 2.7 Low2024-07-09
CVE-2024-3217 WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection CWE-89 8.8 High2024-04-05
CVE-2024-29774 WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High2024-03-27
CVE-2023-31229 WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection CWE-601 4.7 Medium2023-12-29
CVE-2023-2279 WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display CWE-352 5.4 Medium2023-08-31
CVE-2023-2277 WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem CWE-352 6.1 Medium2023-06-13
CVE-2023-2278 WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action CWE-22 9.8 Critical2023-06-13
CVE-2023-2351 WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action CWE-862 6.5 Medium2023-06-13
CVE-2023-2280 WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action CWE-862 6.5 Medium2023-06-09

All 31 known CVE vulnerabilities affecting WP Directory Kit with full Chinese analysis, references, and POCs where available.