WP Directory Kit vulnerabilities
We track 9 vulnerabilities in WP Directory Kit products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on September 26, 2026.
Latest WP Directory Kit vulnerabilities
- 7.2 High severity
WP Directory Kit: Improper Neutralization of Input During Web Page Generation
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management
- 7.2 High severity
WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site re
- 8.6 High severity
WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.
- 8.1 High severity
WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscrib
- 9.1 Critical severity
WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- 7.5 High severity
WP Directory Kit: Exposure of Sensitive Information to an Unauthorized Actor
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 sett
- 7.7 High severity
WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a
- 9.3 Critical severity
WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.
- 9.3 Critical severity
WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0.