Wp Directory Kit
Monthly
Stored cross-site scripting in the WP Directory Kit WordPress plugin before version 1.5.8 lets an authenticated user who holds the plugin's listing-management role (and who does not have the WordPress unfiltered_html capability) inject script into a listing's category and location fields, which the plugin then prints unescaped inside page attributes; the payload persists and executes for any anonymous visitor who views the affected directory page, requiring no further interaction from the victim. The attacker must already possess that elevated listing-management role and the plugin must be installed with directory listings in active use, so this is a genuine but conditional issue rather than a public-facing injection path. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) and EPSS is low at 0.15% (4th percentile); the vendor has released a fix in 1.5.8.
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
SQL injection in the WP Directory Kit WordPress plugin (versions 1.5.4 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through unsanitized input, per a Patchstack disclosure carrying a 9.3 CVSS. Because no login is required (PR:N) and the CVSS marks a scope change with high confidentiality impact, an attacker can read sensitive database contents such as user credentials and WordPress secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
SQL injection in WP Directory Kit versions 1.5.4 and earlier enables remote unauthenticated attackers to extract sensitive database contents, including WordPress user credentials and site configuration data, without any account or prior foothold. The CVSS 3.1 score of 7.5 includes a Scope Changed designation, reflecting that the shared WordPress MySQL database - reachable by all installed plugins - is exposed beyond the plugin's own schema. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network attack path significantly lowers the barrier to exploitation.
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. Patch version 1.5.6 resolves the vulnerability; sites using customized search field configurations are the exposed population.
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including low-privilege Subscribers - to query or manipulate the WordPress database via an AJAX endpoint that performs no input sanitization and enforces no authorization check. With a publicly available proof-of-concept reported by WPScan and an EPSS of 16%, the exploitation barrier is low for any site with user registration enabled. A vendor patch is available in version 1.5.6.
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party secrets - to any authenticated WordPress user, including low-privileged Subscribers, due to missing authorization and nonce validation on an AJAX endpoint. A vendor-released patch (version 1.5.5) is available, and a publicly available proof-of-concept exploit has been published by WPScan. Despite POC availability, EPSS sits at 0.14% (4th percentile), suggesting limited opportunistic exploitation at this time though the technical barrier to abuse is very low.
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticated WordPress user - including low-privilege Subscribers - to query the underlying database and exfiltrate sensitive data. The AJAX action omits both authorization and nonce checks, collapsing what should be a privileged operation to the lowest authenticated tier. A public proof-of-concept exists per WPScan, though EPSS at 0.16% (6th percentile) indicates no widespread automated exploitation at time of analysis; this is not listed in CISA KEV.
Unauthenticated broken access control in the WP Directory Kit WordPress plugin (versions ≤ 1.5.0) allows remote attackers to bypass authorization checks on plugin endpoints and access functionality or data that should require authentication. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36963; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Blind SQL injection in the WP Directory Kit WordPress plugin (versions up to and including 1.5.1) allows remote unauthenticated attackers to inject crafted SQL fragments into backend queries, enabling extraction of database contents and limited tampering with site availability. The CVSS 9.3 score reflects network-reachable exploitation with no privileges or user interaction and a scope change into the WordPress database context; no public exploit identified at time of analysis, though Patchstack has cataloged the flaw.
Blind SQL injection in the WP Directory Kit WordPress plugin (versions up to and including 1.5.0) allows remote unauthenticated attackers to inject SQL commands through improperly neutralized input. With a CVSS 9.3 (scope-changed) rating from Patchstack, successful exploitation can expose sensitive database contents and partially impact availability across the WordPress installation. No public exploit identified at time of analysis and the plugin is not currently listed in CISA KEV.
Time-based blind SQL injection in the WP Directory Kit plugin for WordPress (all versions up to and including 1.5.9) allows authenticated attackers holding subscriber-level access or above to append extra SQL into an existing query and read sensitive information from the site database. The issue is second-order: a subscriber stores a display_name value containing a single quote, which WordPress preserves verbatim, and the payload only fires later when WdkCachedUserEditor::update_listings_user_editor() re-reads that cached value into the SQL sink without escaping or prepared-statement parameterization. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the impact is confidentiality-only and blind, so exfiltration is slow and generates measurable request volume; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Authenticated SQL injection in the WP Directory Kit plugin for WordPress (all versions up to and including 1.5.4) lets an attacker who holds the plugin's 'custom-level access' role or higher append arbitrary SQL into an existing query through the 'data_fields_list' parameter, reading sensitive data out of the WordPress database. The issue is network-reachable, low complexity, and requires no user interaction, but it is gated by the authentication/privilege prerequisite (PR:L), so it cannot be mass-exploited without a prior account; impact is limited to confidentiality (C:H) with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; no EPSS score was supplied with the intelligence.
Blind SQL injection in the WP Directory Kit WordPress plugin, affecting all versions up to and including 1.5.4, lets an authenticated attacker with 'custom-level access and above' append arbitrary SQL to an existing query through the unescaped 'order_by' parameter and extract sensitive data from the site's database. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) because exploitation is network-reachable and low-complexity but gated behind a valid low-privilege account; confidentiality is the only impacted pillar, as the injection is blind and does not permit direct read-out or data modification. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated on sites that expose low-privilege accounts and run a vulnerable plugin version.
WP Directory Kit, a WordPress directory/listing plugin, exposes the content of draft and unapproved listings to anyone who can reach its public AJAX actions. Versions through 1.5.7 omit status and ownership checks before returning listing content, so unauthenticated attackers can enumerate other users' unpublished submissions (CWE-200, information disclosure). Publicly available exploit code exists per the WPScan reference, though EPSS is only 0.14% (4th percentile) and there is no CISA KEV listing, so this is a moderate, opportunistic-targeting issue rather than a mass-exploitation event.
Missing authorization and visibility checks in a WP Directory Kit shortcode (WordPress plugin versions up to and including 1.5.7) allow any logged-in user with a role as low as Contributor to read non-public listing content — including password-protected entries and hidden fields — that belongs to other users. The flaw is an information-disclosure issue (CWE-200) publicly documented by WPScan with exploit detail available, though the EPSS score of 0.14% (4th percentile) and the absence of any CISA KEV entry indicate no confirmed active exploitation and low predicted mass-exploitation risk. Impact is confidentiality-only and limited in scope: no data modification, no denial of service, and no privilege escalation beyond the reading of restricted listing data.
SQL injection in the WP Directory Kit WordPress plugin (versions through 1.5.7) lets authenticated users with page-builder access (Editor role and above) inject arbitrary SQL through widget settings that are stored without sanitization or escaping and then concatenated into a database query. The injected statement executes when the affected page is rendered, allowing the attacker to read arbitrary data from the WordPress database. Publicly available exploit code exists (WPScan advisory) and the vendor CPE is still listed as 'unknown', but there is no CISA KEV entry and EPSS is only 0.16%, indicating targeted rather than opportunistic mass exploitation.
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to missing authorization and nonce validation on an AJAX endpoint. Any subscriber-level account holder can trigger the vulnerable action to enumerate the full WordPress user list and access unpublished directory listings belonging to other users - data that should be restricted to privileged roles. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), suggesting exploitation has not yet become widespread despite the low barrier to abuse.
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated user - including low-privilege Subscribers - to retrieve stored contact messages and associated personal data belonging to other users by invoking an unprotected AJAX endpoint. The root cause is the complete absence of WordPress authorization checks and nonce verification on an authenticated AJAX action, meaning the plugin performs no ownership or permission validation before returning sensitive inter-user data. A publicly available proof-of-concept has been published by WPScan; however, EPSS sits at just 0.14% (4th percentile) and no CISA KEV listing exists, indicating low observed exploitation activity at time of analysis despite the public PoC.
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.2.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpdirectorykit.Com WP Directory Kit allows Reflected XSS.3.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.3.6. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and including, 1.3.0 due to insufficient. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 47.2%.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.2.9. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP Directory Kit.1.9. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_admin' function in versions up to, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stored cross-site scripting in the WP Directory Kit WordPress plugin before version 1.5.8 lets an authenticated user who holds the plugin's listing-management role (and who does not have the WordPress unfiltered_html capability) inject script into a listing's category and location fields, which the plugin then prints unescaped inside page attributes; the payload persists and executes for any anonymous visitor who views the affected directory page, requiring no further interaction from the victim. The attacker must already possess that elevated listing-management role and the plugin must be installed with directory listings in active use, so this is a genuine but conditional issue rather than a public-facing injection path. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) and EPSS is low at 0.15% (4th percentile); the vendor has released a fix in 1.5.8.
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
SQL injection in the WP Directory Kit WordPress plugin (versions 1.5.4 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through unsanitized input, per a Patchstack disclosure carrying a 9.3 CVSS. Because no login is required (PR:N) and the CVSS marks a scope change with high confidentiality impact, an attacker can read sensitive database contents such as user credentials and WordPress secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
SQL injection in WP Directory Kit versions 1.5.4 and earlier enables remote unauthenticated attackers to extract sensitive database contents, including WordPress user credentials and site configuration data, without any account or prior foothold. The CVSS 3.1 score of 7.5 includes a Scope Changed designation, reflecting that the shared WordPress MySQL database - reachable by all installed plugins - is exposed beyond the plugin's own schema. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network attack path significantly lowers the barrier to exploitation.
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. Patch version 1.5.6 resolves the vulnerability; sites using customized search field configurations are the exposed population.
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including low-privilege Subscribers - to query or manipulate the WordPress database via an AJAX endpoint that performs no input sanitization and enforces no authorization check. With a publicly available proof-of-concept reported by WPScan and an EPSS of 16%, the exploitation barrier is low for any site with user registration enabled. A vendor patch is available in version 1.5.6.
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party secrets - to any authenticated WordPress user, including low-privileged Subscribers, due to missing authorization and nonce validation on an AJAX endpoint. A vendor-released patch (version 1.5.5) is available, and a publicly available proof-of-concept exploit has been published by WPScan. Despite POC availability, EPSS sits at 0.14% (4th percentile), suggesting limited opportunistic exploitation at this time though the technical barrier to abuse is very low.
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticated WordPress user - including low-privilege Subscribers - to query the underlying database and exfiltrate sensitive data. The AJAX action omits both authorization and nonce checks, collapsing what should be a privileged operation to the lowest authenticated tier. A public proof-of-concept exists per WPScan, though EPSS at 0.16% (6th percentile) indicates no widespread automated exploitation at time of analysis; this is not listed in CISA KEV.
Unauthenticated broken access control in the WP Directory Kit WordPress plugin (versions ≤ 1.5.0) allows remote attackers to bypass authorization checks on plugin endpoints and access functionality or data that should require authentication. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36963; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Blind SQL injection in the WP Directory Kit WordPress plugin (versions up to and including 1.5.1) allows remote unauthenticated attackers to inject crafted SQL fragments into backend queries, enabling extraction of database contents and limited tampering with site availability. The CVSS 9.3 score reflects network-reachable exploitation with no privileges or user interaction and a scope change into the WordPress database context; no public exploit identified at time of analysis, though Patchstack has cataloged the flaw.
Blind SQL injection in the WP Directory Kit WordPress plugin (versions up to and including 1.5.0) allows remote unauthenticated attackers to inject SQL commands through improperly neutralized input. With a CVSS 9.3 (scope-changed) rating from Patchstack, successful exploitation can expose sensitive database contents and partially impact availability across the WordPress installation. No public exploit identified at time of analysis and the plugin is not currently listed in CISA KEV.
Time-based blind SQL injection in the WP Directory Kit plugin for WordPress (all versions up to and including 1.5.9) allows authenticated attackers holding subscriber-level access or above to append extra SQL into an existing query and read sensitive information from the site database. The issue is second-order: a subscriber stores a display_name value containing a single quote, which WordPress preserves verbatim, and the payload only fires later when WdkCachedUserEditor::update_listings_user_editor() re-reads that cached value into the SQL sink without escaping or prepared-statement parameterization. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the impact is confidentiality-only and blind, so exfiltration is slow and generates measurable request volume; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Authenticated SQL injection in the WP Directory Kit plugin for WordPress (all versions up to and including 1.5.4) lets an attacker who holds the plugin's 'custom-level access' role or higher append arbitrary SQL into an existing query through the 'data_fields_list' parameter, reading sensitive data out of the WordPress database. The issue is network-reachable, low complexity, and requires no user interaction, but it is gated by the authentication/privilege prerequisite (PR:L), so it cannot be mass-exploited without a prior account; impact is limited to confidentiality (C:H) with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; no EPSS score was supplied with the intelligence.
Blind SQL injection in the WP Directory Kit WordPress plugin, affecting all versions up to and including 1.5.4, lets an authenticated attacker with 'custom-level access and above' append arbitrary SQL to an existing query through the unescaped 'order_by' parameter and extract sensitive data from the site's database. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) because exploitation is network-reachable and low-complexity but gated behind a valid low-privilege account; confidentiality is the only impacted pillar, as the injection is blind and does not permit direct read-out or data modification. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated on sites that expose low-privilege accounts and run a vulnerable plugin version.
WP Directory Kit, a WordPress directory/listing plugin, exposes the content of draft and unapproved listings to anyone who can reach its public AJAX actions. Versions through 1.5.7 omit status and ownership checks before returning listing content, so unauthenticated attackers can enumerate other users' unpublished submissions (CWE-200, information disclosure). Publicly available exploit code exists per the WPScan reference, though EPSS is only 0.14% (4th percentile) and there is no CISA KEV listing, so this is a moderate, opportunistic-targeting issue rather than a mass-exploitation event.
Missing authorization and visibility checks in a WP Directory Kit shortcode (WordPress plugin versions up to and including 1.5.7) allow any logged-in user with a role as low as Contributor to read non-public listing content — including password-protected entries and hidden fields — that belongs to other users. The flaw is an information-disclosure issue (CWE-200) publicly documented by WPScan with exploit detail available, though the EPSS score of 0.14% (4th percentile) and the absence of any CISA KEV entry indicate no confirmed active exploitation and low predicted mass-exploitation risk. Impact is confidentiality-only and limited in scope: no data modification, no denial of service, and no privilege escalation beyond the reading of restricted listing data.
SQL injection in the WP Directory Kit WordPress plugin (versions through 1.5.7) lets authenticated users with page-builder access (Editor role and above) inject arbitrary SQL through widget settings that are stored without sanitization or escaping and then concatenated into a database query. The injected statement executes when the affected page is rendered, allowing the attacker to read arbitrary data from the WordPress database. Publicly available exploit code exists (WPScan advisory) and the vendor CPE is still listed as 'unknown', but there is no CISA KEV entry and EPSS is only 0.16%, indicating targeted rather than opportunistic mass exploitation.
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to missing authorization and nonce validation on an AJAX endpoint. Any subscriber-level account holder can trigger the vulnerable action to enumerate the full WordPress user list and access unpublished directory listings belonging to other users - data that should be restricted to privileged roles. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile), suggesting exploitation has not yet become widespread despite the low barrier to abuse.
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated user - including low-privilege Subscribers - to retrieve stored contact messages and associated personal data belonging to other users by invoking an unprotected AJAX endpoint. The root cause is the complete absence of WordPress authorization checks and nonce verification on an authenticated AJAX action, meaning the plugin performs no ownership or permission validation before returning sensitive inter-user data. A publicly available proof-of-concept has been published by WPScan; however, EPSS sits at just 0.14% (4th percentile) and no CISA KEV listing exists, indicating low observed exploitation activity at time of analysis despite the public PoC.
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.2.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpdirectorykit.Com WP Directory Kit allows Reflected XSS.3.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.3.6. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and including, 1.3.0 due to insufficient. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 47.2%.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.2.9. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP Directory Kit.1.9. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_admin' function in versions up to, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.