Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

e-plugins — Vulnerabilities & Security Advisories 33

Browse all 33 CVE security advisories affecting e-plugins. AI-powered Chinese analysis, POCs, and references for each vulnerability.

e-plugins function as a comprehensive suite of WordPress extensions designed to enhance website functionality, including security, SEO, and performance optimization. With thirty-two recorded Common Vulnerabilities and Exposures (CVEs), the software has historically been susceptible to critical security flaws. These vulnerabilities predominantly involve Remote Code Execution (RCE), Cross-Site Scripting (XSS), and privilege escalation, often stemming from insufficient input validation and improper access controls within specific modules. While the platform offers robust features for site management, its attack surface has attracted significant attention from threat actors seeking to compromise underlying server infrastructure. Security audits highlight that many incidents result from outdated versions lacking recent patches. Consequently, administrators must prioritize regular updates and strict permission management to mitigate risks associated with these known weaknesses, ensuring the integrity of the hosted environment against potential exploitation.

CVE ID Title CVSS Severity Published
CVE-2026-66649 WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability — Directory Pro CWE-89 9.3 Critical 2026-08-20
CVE-2026-28127 WordPress Lawyer Directory plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability — Lawyer Directory CWE-79 7.1 High 2026-03-05
CVE-2026-27396 WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability — Directory Pro CWE-862 7.3 High 2026-03-05
CVE-2025-69193 WordPress WP Membership plugin <= 1.6.4 - Broken Access Control vulnerability — WP Membership CWE-862 7.3 High 2026-01-22
CVE-2025-69192 WordPress Real Estate Pro plugin <= 2.1.5 - Broken Access Control vulnerability — Real Estate Pro CWE-862 7.3 High 2026-01-22
CVE-2025-69292 WordPress WP Membership plugin <= 1.6.4 - Privilege Escalation vulnerability — WP Membership CWE-266 8.8 High 2026-01-22
CVE-2025-69293 WordPress Final User plugin <= 1.2.5 - Privilege Escalation vulnerability — Final User CWE-266 8.8 High 2026-01-22
CVE-2025-69187 WordPress Final User plugin <= 1.2.5 - Broken Access Control vulnerability — Final User CWE-862 7.3 High 2026-01-22
CVE-2025-69191 WordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerability — ListingHub CWE-862 7.3 High 2026-01-22
CVE-2025-69190 WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability — Listihub CWE-862 7.3 High 2026-01-22
CVE-2025-69188 WordPress fitness-trainer plugin <= 1.7.1 - Broken Access Control vulnerability — fitness-trainer CWE-862 7.3 High 2026-01-22
CVE-2025-69184 WordPress Institutions Directory plugin <= 1.3.4 - Broken Access Control vulnerability — Institutions Directory CWE-862 7.3 High 2026-01-22
CVE-2025-69183 WordPress Hospital Doctor Directory plugin <= 1.3.9 - Privilege Escalation vulnerability — Hospital Doctor Directory CWE-266 8.8 High 2026-01-22
CVE-2025-69182 WordPress Institutions Directory plugin <= 1.3.4 - Privilege Escalation vulnerability — Institutions Directory CWE-266 8.8 High 2026-01-22
CVE-2025-69185 WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability — Hotel Listing CWE-862 7.3 High 2026-01-22
CVE-2025-69186 WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability — Hospital Doctor Directory CWE-862 7.3 High 2026-01-22
CVE-2025-69181 WordPress Lawyer Directory plugin <= 1.3.4 - Broken Access Control vulnerability — Lawyer Directory CWE-862 7.3 High 2026-01-22
CVE-2025-69056 WordPress Hotel Listing plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability — Hotel Listing CWE-79 7.1 High 2026-01-22
CVE-2025-68059 WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability — Hotel Listing CWE-862 7.6 High 2026-01-22
CVE-2025-68058 WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability — Institutions Directory CWE-862 7.6 High 2026-01-22
CVE-2025-68057 WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability — Hospital Doctor Directory CWE-862 7.6 High 2026-01-22
CVE-2025-67967 WordPress Lawyer Directory plugin <= 1.3.3 - Broken Access Control vulnerability — Lawyer Directory CWE-862 7.6 High 2026-01-22
CVE-2025-67966 WordPress Lawyer Directory plugin <= 1.3.3 - Privilege Escalation vulnerability — Lawyer Directory CWE-266 8.8 High 2026-01-22
CVE-2025-12551 WordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerability — ListingHub CWE-79 7.1 High 2026-01-08
CVE-2025-13504 WordPress Real Estate Pro plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability — Real Estate Pro CWE-79 7.1 High 2026-01-08
CVE-2025-69085 WordPress JobBank plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability — JobBank CWE-79 7.1 High 2026-01-06
CVE-2025-58710 WordPress Hotel Listing plugin <= 1.4.0 - Privilege Escalation vulnerability — Hotel Listing CWE-266 8.8 High 2025-12-18
CVE-2025-64243 WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability — Directory Pro CWE-862 4.3 Medium 2025-12-16
CVE-2025-58638 WordPress Institutions Directory Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability — Institutions Directory CWE-79 7.1 High 2025-11-06
CVE-2025-52748 WordPress Directory Pro plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerability — Directory Pro CWE-79 7.1 High 2025-10-22

This page lists every published CVE security advisory associated with e-plugins. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.