28
CVEs
3
Critical
9
High
0
KEV
7
PoC
9
Unpatched C/H
17.9%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
9
MEDIUM
16
LOW
0
Monthly CVE Trend
Affected Products (10)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2021-24981 | The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.8% | 58 |
PoC
No patch
|
| CVE-2022-3930 | The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.6% | 52 |
PoC
No patch
|
| CVE-2022-3961 | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 0.7% | 52 |
PoC
No patch
|
| CVE-2026-32474 | Arbitrary file upload in the Templatiq WordPress plugin (versions ≤ 0.2.5) lets authenticated users holding only Contributor-level privileges upload files without adequate type or content validation (CWE-434), enabling upload of executable PHP and full site compromise. The flaw was reported by Patchstack and carries a vendor CVSS of 9.9 driven by a scope change and low privilege barrier. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.4% | 50 |
No patch
|
| CVE-2026-59518 | PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass untrusted serialized data into a PHP deserialization sink, instantiating arbitrary objects that can trigger POP gadget chains for code execution, data theft, or site compromise. The flaw carries a critical 9.8 CVSS score with an unauthenticated network vector; it was disclosed by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2022-2376 | The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.3 | 1.4% | 46 |
PoC
No patch
|
| CVE-2024-2006 | The Post Grid, Slider & Carousel Ultimate - with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects. | HIGH | 8.8 | 2.0% | 46 |
|
| CVE-2026-3141 | Unauthorized arbitrary file deletion in the FormGent WordPress plugin (versions up to and including 1.9.2) allows unauthenticated remote attackers to delete files via the /wp-json/formgent/responses/attachments REST endpoint, which was registered with no authentication middleware. On Linux hosts where the wp-content/uploads/formgent directory has not yet been created (the default post-install state), path-traversal protections can be bypassed to delete files outside the intended directory, including wp-config.php - enabling full site takeover through the fresh-install re-configuration flow. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the CVSS score is 9.1 (Critical). | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2022-2046 | The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 4.9 | 0.8% | 44 |
PoC
No patch
|
| CVE-2023-1888 | The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2022-1266 | The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 4.8 | 0.6% | 44 |
PoC
No patch
|
| CVE-2023-47824 | Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages - Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-49073 | Blind SQL injection in the wpWax Directorist Booking WordPress plugin (versions up to and including 3.0.3) allows authenticated low-privilege users to issue crafted database queries that exfiltrate data across trust boundaries. The CVSS 3.1 score of 8.5 reflects a scope change (S:C) with high confidentiality impact, indicating the affected database context exposes data beyond the plugin's own component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.5 | 0.3% | 42 |
No patch
|
| CVE-2022-2377 | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 4.3 | 0.3% | 42 |
PoC
No patch
|
| CVE-2025-1570 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available. | HIGH | 8.1 | 0.4% | 41 |
No patch
|