Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

• CVE-2026-118534 Medium 4.3 Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR –
• CVE-2026-118533 Medium 4.3 Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt –
• CVE-2026-118532 Medium 6.5 Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field –
• CVE-2026-118530 Medium 5.0 Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action –
• CVE-2026-118529 Low 3.1 Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout –
• CVE-2026-118528 Medium 4.3 Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR –
• CVE-2026-84150 Medium 5.4 Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint 0.2%
• CVE-2026-84098 Medium 6.5 Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing 0.3%
• CVE-2026-84046 Medium 5.0 Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL 0.3%
• CVE-2026-84027 Medium 4.3 Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint 0.3%
• CVE-2026-84026 Medium 5.3 Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint 0.3%
• CVE-2026-77766 Medium 4.3 Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint 0.3%
• CVE-2026-84066 Low 3.1 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload 0.2%
• CVE-2026-77757 Medium 5.4 Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission 0.3%