WordPress plugin · directorist
Is Directorist safe?
Safe on 8.10.5 or newer.
The current version, 8.10.5, is past every affected range on record (32 of 32 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 32
- High or critical
- 7
- Exploited
- none
- Current version
- 8.10.5
- Last updated
- Oct 18, 2026
- Active installs
- 20,000+
Every recorded flaw
- Oct 14, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Stored Cross-Site ScriptingCVE-2026-100185 · affects up to 8.10.2.1 · reported by WordfenceMedium 6.4
- Oct 13, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Authorization bypassCVE-2026-17092 · affects up to 8.10.2.1 · reported by WordfenceHigh 8.1
- Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favoritesCVE-2026-84150 · fixed in 8.9.5 · reported by WPScanMedium 5.4
- Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not properly verify a listing's ownership before deleting itCVE-2026-84098 · fixed in 8.9.5 · reported by WPScanMedium 6.5
- Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not validate a user-supplied URL before fetching it server-sideCVE-2026-84046 · fixed in 8.9.5 · reported by WPScanMedium 5
- Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not check user capabilitiesCVE-2026-84027 · fixed in 8.9.5 · reported by WPScanMedium 4.3
- Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not restrict access to a REST endpoint that returns user recordsCVE-2026-84026 · fixed in 8.9.5 · reported by WPScanMedium 5.3
- Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not scope one of its REST collection endpoints to the requesting userCVE-2026-77766 · fixed in 8.9.5 · reported by WPScanMedium 4.3
- Sep 4, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadataCVE-2026-84066 · fixed in 8.9 · reported by WPScanLow 3.1
- Aug 26, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not sanitize a user-supplied image reference before using itCVE-2026-77757 · fixed in 8.9.3 · reported by WPScanMedium 5.4
- Jul 13, 2026Directorist: Deserialization of Untrusted DataCVE-2026-59518 · affects up to 8.8.2 · reported by PatchstackCritical 9.8
- Apr 8, 2026Directorist: Missing AuthorizationCVE-2026-39509 · affects up to 8.5.10 · reported by PatchstackMedium 5.3
- Feb 20, 2026Directorist: Missing AuthorizationCVE-2025-68069 · affects up to 8.6.6 · reported by PatchstackHigh 7.1
- Dec 16, 2025Directorist: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-64250 · affects up to 8.6.6 · reported by PatchstackMedium 4.7
- Nov 19, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Unauthorized accessCVE-2025-12174 · affects up to 8.5.2 · reported by WordfenceMedium 6.5
- Oct 25, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Arbitrary file moveCVE-2025-10488 · affects up to 8.4.8 · reported by WordfenceHigh 8.1
- Mar 25, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Unauthorized access and modification of dataCVE-2025-2224 · affects up to 8.2 · reported by WordfenceMedium 5.3
- Feb 28, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Privilege escalationCVE-2025-1570 · affects up to 8.1 · reported by WordfenceHigh 8.1
- Feb 1, 2025Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings: Information ExposureCVE-2024-12041 · affects up to 8.0.12 · reported by WordfenceMedium 5.3
- Dec 13, 2024Directorist: Missing AuthorizationCVE-2023-35052 · affects up to 7.5.4 · reported by PatchstackMedium 4.3
- May 3, 2024Directorist: Missing AuthorizationCVE-2024-33929 · affects up to 7.8.6 · reported by PatchstackMedium 5.3
- Feb 28, 2024Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Unauthorized modification of dataCVE-2024-1322 · affects up to 7.8.4 · reported by WordfenceMedium 5.3
- Jan 16, 2024Directorist: Is vulnerable to Local File InclusionCVE-2023-2252 · fixed in 7.5.4 · reported by WPScan1.3% oddsLow 2.7
- Nov 7, 2023Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-41798 · affects up to 7.7.1 · reported by PatchstackMedium 5.1
- Jun 9, 2023Directorist: An Insecure Direct Object ReferenceCVE-2023-1889 · affects up to 7.5.4 · reported by WordfenceMedium 6.5
- Jun 9, 2023Directorist: An arbitrary user password resetCVE-2023-1888 · affects up to 7.5.4 · reported by WordfenceHigh 8.8
- Dec 19, 2022Directorist: Does not prevent users with low privileges (like subscribers) from accessing sensitive system informationCVE-2022-3961 · fixed in 7.4.4 · reported by WPScanMedium 6.5
- Dec 12, 2022Directorist: Suffers from an IDOR vulnerabilityCVE-2022-3930 · fixed in 7.4.2.2 · reported by WPScanMedium 6.5
- Sep 5, 2022The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticatedCVE-2022-2376 · fixed in 7.3.1 · reported by WPScan1.8% oddsMedium 5.3
- Aug 22, 2022Directorist: Does not have authorisation and CSRF checks in an AJAX actionCVE-2022-2377 · fixed in 7.3.0 · reported by WPScanMedium 4.3
- Aug 8, 2022Directorist: Allows administrators to download other plugins from the same vendor directly to the siteCVE-2022-2046 · fixed in 7.2.3 · reported by WPScan1.0% oddsMedium 4.9
- Dec 21, 2021Directorist: Was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directoryCVE-2021-24981 · fixed in 7.0.6.2 · reported by WPScanHigh 7.5
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.