Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wpdirectorykit
WP Directory Kit
40 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 10, 2026WP Directory Kit: Time-based SQL InjectionCVE-2026-96653 · affects up to 1.5.9 · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a display_name containing a single quote via their own profile, which WordPress preserves verbatim; the payload is then triggered when WdkCachedUserEditor::update_listings_user_editor() re-reads that stored value and passes it unsanitized to the SQL sink.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026WP Directory Kit: Generic SQL InjectionCVE-2026-16596 · affects up to 1.5.4 · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Sep 26, 2026WP Directory Kit: Does not sanitize and escape some of its category and location fields before outputting them in page attributesCVE-2026-16591 · fixed in 1.5.8 · reported by WPScanHigh 7.2
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.
Sep 16, 2026WP Directory Kit: Blind SQL InjectionCVE-2026-16588 · affects up to 1.5.4 · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Sep 15, 2026WP Directory Kit: Does not check the status or ownership of a listing before returning its content through one of its public AJAX actionsCVE-2026-18232 · affects up to 1.5.7 · reported by WPScanMedium 5.3
The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.
Sep 15, 2026WP Directory Kit: Does not sanitize and escape some widget settings before using them in a SQL statementCVE-2026-16593 · affects up to 1.5.7 · reported by WPScanMedium 6.8
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.
Sep 15, 2026WP Directory Kit: Does not check authorization or listing visibility in one of its shortcodesCVE-2026-16592 · affects up to 1.5.7 · reported by WPScanLow 2.7
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
Aug 19, 2026WP Directory Kit: Does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rowsCVE-2026-18231 · fixed in 1.5.7 · reported by WPScanMedium 5.3
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles.
Aug 16, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-18653 · fixed in 1.5.7 · reported by WPScanHigh 7.2
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach.
Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-28001 · affects up to 1.5.4 · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-27538 · affects up to 1.5.4 · reported by PatchstackHigh 7.5
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-18474 · fixed in 1.5.6 · reported by WPScanHigh 8.6
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.
Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-18230 · fixed in 1.5.6 · reported by WPScanHigh 8.1
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
Aug 9, 2026WP Directory Kit: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-18473 · fixed in 1.5.5 · reported by WPScanCritical 9.1
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16595 · fixed in 1.5.5 · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16594 · fixed in 1.5.5 · reported by WPScanHigh 7.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16590 · fixed in 1.5.5 · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
Aug 8, 2026WP Directory Kit: Does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-16589 · fixed in 1.5.5 · reported by WPScanHigh 7.7
The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
Jun 15, 2026Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.CVE-2026-39534 · affects up to 1.5.0 · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.
Jun 1, 2026WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42672 · affects up to 1.5.1 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.
May 21, 2026WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39531 · affects up to 1.5.0 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0.
Jan 24, 2026WP Directory Kit: Sensitive Information ExposureCVE-2025-13920 · affects up to 1.4.9 · reported by WordfenceMedium 5.3
The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the wdk_public_action AJAX handler. This makes it possible for unauthenticated attackers to extract email addresses for users with Directory Kit-specific user roles.
Dec 13, 2025WP Directory Kit: SQL InjectionCVE-2025-13089 · affects up to 1.4.7 · reported by WordfenceHigh 7.5
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 3, 2025WP Directory Kit: Authentication bypassCVE-2025-13390 · affects up to 1.4.4 · reported by WordfenceCritical 10
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
Dec 2, 2025WP Directory Kit: SQL InjectionCVE-2025-13090 · affects up to 1.4.6 · reported by WordfenceMedium 4.9
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 27, 2025WP Directory Kit: Reflected Cross-Site ScriptingCVE-2025-13525 · affects up to 1.4.5 · reported by WordfenceMedium 6.1
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025WP Directory Kit: SQL InjectionCVE-2025-13138 · affects up to 1.4.3 · reported by WordfenceHigh 7.5
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2025WP Directory Kit: Missing AuthorizationCVE-2025-60120 · affects up to 1.4.0 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.
Dec 13, 2024WP Directory Kit: Missing AuthorizationCVE-2023-41875 · affects up to 1.2.6 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6.
Jul 21, 2024WP Directory Kit: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37487 · affects up to 1.3.5 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpdirectorykit.Com WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.3.5.
Jul 9, 2024WP Directory Kit: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CVE-2024-37253 · affects up to 1.3.6 · reported by PatchstackLow 2.7
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6.
Apr 5, 2024WP Directory Kit: SQL InjectionCVE-2024-3217 · affects up to 1.3.0 · reported by WordfenceHigh 8.8
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 27, 2024WP Directory Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29774 · affects up to 1.2.9 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.2.9.
Dec 29, 2023WP Directory Kit: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-31229 · affects up to 1.1.9 · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP Directory Kit.This issue affects WP Directory Kit: from n/a through 1.1.9.
Aug 31, 2023WP Directory Kit: Cross-Site Request ForgeryCVE-2023-2279 · affects up to 1.2.1 · reported by WordfenceMedium 5.4
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'admin_page_display' function. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, modify or delete Directory Kit related posts and terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Partial patches were made avilable in versions 1.2.0 and 1.2.1 but the issue was not fully patched until 1.2.2
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 12, 2023WP Directory Kit: Unauthorized modification of data and loss of dataCVE-2023-2351 · affects up to 1.2.3 · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_admin' function in versions up to, and including, 1.2.3. This makes it possible for authenticated attackers with subscriber-level permissions or above to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 12, 2023WP Directory Kit: Local File InclusionCVE-2023-2278 · affects up to 1.1.9 · reported by WordfenceCritical 9.8
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 12, 2023WP Directory Kit: Cross-Site Request ForgeryCVE-2023-2277 · affects up to 1.1.9 · reported by WordfenceMedium 6.1
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2023WP Directory Kit: Unauthorized modification of data and loss of dataCVE-2023-2280 · affects up to 1.2.2 · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0 and an additional partial patch was introduced in version 1.2.2, but the issue was not fully patched until 1.2.3.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2023WP Directory Kit: Reflected Cross-Site ScriptingCVE-2023-2835 · affects up to 1.2.3 · reported by WordfenceMedium 6.1
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.