WWPDirectoryKit

Products

Exploited and recent CVEs

• CVE-2026-109197 High 7.5 WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter 0.4%
• CVE-2026-96653 Medium 6.5 WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order) 0.2%
• CVE-2026-16596 Medium 6.5 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter 0.2%
• CVE-2026-16588 Medium 6.5 WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter 0.4%
• CVE-2026-28001 Critical 9.3 WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability 0.4%
• CVE-2026-27538 High 7.5 WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability 0.3%
• CVE-2025-13920 Medium 5.3 WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action 0.7%
• CVE-2025-14618 Medium 4.3 Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion 0.2%
• CVE-2025-13089 High 7.5 WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection 0.4%
• CVE-2025-13090 Medium 4.9 WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection 0.3%
• CVE-2025-13525 Medium 6.1 WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter 0.3%
• CVE-2025-13138 High 7.5 WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function 1.6%
• CVE-2025-60120 Medium 5.3 WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability 0.3%
• CVE-2025-58262 High 7.1 WordPress Sweet Energy Efficiency plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
• CVE-2024-37253 Low 2.7 WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability 0.3%
• CVE-2024-3217 High 8.8 WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection 1.9%
• CVE-2024-29774 High 7.1 WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability 0.4%
• CVE-2023-2279 Medium 5.4 WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display 0.3%
• CVE-2023-2278 Critical 9.8 WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action 1.7%
• CVE-2023-2277 Medium 6.1 WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem 0.3%
• CVE-2023-2351 Medium 6.5 WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action 0.6%
• CVE-2023-2280 Medium 6.5 WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action 0.6%
• CVE-2023-2835 Medium 6.1 WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search' 0.7%