wpWax Directorist: AI-Powered Business Directory, Listings & Classified Ads

• CVE-2026-100185 Medium 6.4 Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field 0.2%
• CVE-2026-17092 High 8.1 Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter 0.5%
• CVE-2025-12174 Medium 6.5 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update 0.2%
• CVE-2025-10488 High 8.1 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move 0.9%
• CVE-2025-2224 Medium 5.3 Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing 0.4%
• CVE-2025-1570 High 8.1 Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP 0.4%
• CVE-2024-12041 Medium 5.3 Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure 0.4%
• CVE-2024-1322 Medium 5.3 Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change 0.5%
• CVE-2023-1889 Medium 6.5 Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task 0.6%
• CVE-2023-1888 High 8.8 Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation 1.0%