Vulnerabilities and security researches forwpdirectorykit wpdirectorykit

Direction: descending

Apr 24, 2026

WP Directory Kit # CVE-2026-39531

CVE, Research URL: CVE-2026-39531
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: -
Research Description: WP Directory Kit [wpdirectorykit] < 1.5.1 CVE-2026-39531
Affected versions: max 1.5.1.
Status: vulnerable

Jan 27, 2026

WP Directory Kit # CVE-2025-13920

CVE, Research URL: CVE-2025-13920
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Jan 24, 2026
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the wdk_public_action AJAX handler. This makes it possible for unauthenticated attackers to extract email addresses for users with Directory Kit-specific user roles.
Affected versions: max 1.5.0.
Status: vulnerable

Jan 11, 2026

WP Directory Kit # CVE-2025-13089

CVE, Research URL: CVE-2025-13089
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Dec 13, 2025
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 1.4.8.
Status: vulnerable

Dec 11, 2025

WP Directory Kit # CVE-2025-13525

CVE, Research URL: CVE-2025-13525
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Nov 27, 2025
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 1.4.6.
Status: vulnerable

WP Directory Kit # CVE-2025-13138

CVE, Research URL: CVE-2025-13138
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Nov 21, 2025
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 1.4.4.
Status: vulnerable

WP Directory Kit # CVE-2025-13090

CVE, Research URL: CVE-2025-13090
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Dec 02, 2025
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 1.4.7.
Status: vulnerable

WP Directory Kit # CVE-2025-13390

CVE, Research URL: CVE-2025-13390
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Dec 03, 2025
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
Affected versions: max 1.4.5.
Status: vulnerable

Oct 11, 2025

WP Directory Kit # CVE-2025-60120

CVE, Research URL: CVE-2025-60120
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Sep 26, 2025
Research Description: Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.
Affected versions: max 1.4.1.
Status: vulnerable

Jul 08, 2024

WP Directory Kit # CVE-2024-37487

CVE, Research URL: CVE-2024-37487
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Jul 21, 2024
Research Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpdirectorykit.Com WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.3.5.
Affected versions: max 1.3.6.
Status: vulnerable

Jun 30, 2024

WP Directory Kit # CVE-2024-37253

CVE, Research URL: CVE-2024-37253
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Jul 09, 2024
Research Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6.
Affected versions: max 1.3.7.
Status: vulnerable

Jun 10, 2024

WP Directory Kit # CVE-2023-41875

CVE, Research URL: CVE-2023-41875
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Dec 13, 2024
Research Description: Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6.
Affected versions: max 1.2.7.
Status: vulnerable

Jun 06, 2024

WP Directory Kit # CVE-2023-2835

CVE, Research URL: CVE-2023-2835
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Jun 02, 2023
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 1.2.4.
Status: vulnerable

WP Directory Kit # CVE-2023-2351

CVE, Research URL: CVE-2023-2351
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Jun 13, 2023
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_admin' function in versions up to, and including, 1.2.3. This makes it possible for authenticated attackers with subscriber-level permissions or above to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0.
Affected versions: max 1.2.4.
Status: vulnerable

WP Directory Kit # CVE-2023-2278

CVE, Research URL: CVE-2023-2278
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Jun 13, 2023
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected versions: max 1.2.4.
Status: vulnerable

WP Directory Kit # CVE-2023-2277

CVE, Research URL: CVE-2023-2277
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Jun 13, 2023
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 1.2.2.
Status: vulnerable

WP Directory Kit # CVE-2023-2280

CVE, Research URL: CVE-2023-2280
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Jun 09, 2023
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0 and an additional partial patch was introduced in version 1.2.2, but the issue was not fully patched until 1.2.3.
Affected versions: max 1.2.3.
Status: vulnerable

WP Directory Kit # CVE-2024-29774

CVE, Research URL: CVE-2024-29774
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Mar 27, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.2.9.
Affected versions: max 1.3.0.
Status: vulnerable

WP Directory Kit # CVE-2024-3217

CVE, Research URL: CVE-2024-3217
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Apr 05, 2024
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 1.3.1.
Status: vulnerable

WP Directory Kit # CVE-2023-31229

CVE, Research URL: CVE-2023-31229
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Dec 29, 2023
Research Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP Directory Kit.This issue affects WP Directory Kit: from n/a through 1.1.9.
Affected versions: max 1.2.0.
Status: vulnerable

WP Directory Kit # CVE-2023-2279

CVE, Research URL: CVE-2023-2279
Home page URL: Security reports for WP Directory Kit
Application: WP Directory Kit
Date: Aug 31, 2023
Research Description: The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'admin_page_display' function. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, modify or delete Directory Kit related posts and terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Partial patches were made avilable in versions 1.2.0 and 1.2.1 but the issue was not fully patched until 1.2.2
Affected versions: max 1.2.2.
Status: vulnerable