Unknown WP Directory Kit

• CVE-2026-16591 High 7.2 WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields 0.3%
• CVE-2026-18232 Medium 5.3 WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow 0.3%
• CVE-2026-16592 Low 2.7 WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes 0.3%
• CVE-2026-16593 Medium 6.8 WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings 0.4%
• CVE-2026-18231 Medium 5.3 WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user 0.3%
• CVE-2026-18653 High 7.2 WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter 0.4%
• CVE-2026-18474 High 8.6 WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category 0.4%
• CVE-2026-18230 High 8.1 WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter 0.4%
• CVE-2026-18473 Critical 9.1 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter 0.5%
• CVE-2026-16595 Medium 6.5 WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure 0.4%
• CVE-2026-16594 High 7.5 WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure 0.4%
• CVE-2026-16590 Medium 6.5 WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure 0.4%
• CVE-2026-16589 High 7.7 WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter 0.4%