WordPress plugin · wpdirectorykit
Is WP Directory Kit safe?
Safe on 1.6.1 or newer.
The current version, 1.6.1, is past every affected range on record (40 of 40 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 40
- High or critical
- 19
- Exploited
- none
- Current version
- 1.6.1
- Last updated
- Oct 16, 2026
- Active installs
- 2,000+
Every recorded flaw
- Oct 10, 2026WP Directory Kit: Time-based SQL InjectionCVE-2026-96653 · affects up to 1.5.9 · reported by WordfenceMedium 6.5
- Sep 30, 2026WP Directory Kit: Generic SQL InjectionCVE-2026-16596 · affects up to 1.5.4 · reported by WordfenceMedium 6.5
- Sep 26, 2026WP Directory Kit: Does not sanitize and escape some of its category and location fields before outputting them in page attributesCVE-2026-16591 · fixed in 1.5.8 · reported by WPScanHigh 7.2
- Sep 16, 2026WP Directory Kit: Blind SQL InjectionCVE-2026-16588 · affects up to 1.5.4 · reported by WordfenceMedium 6.5
- Sep 15, 2026WP Directory Kit: Does not check the status or ownership of a listing before returning its content through one of its public AJAX actionsCVE-2026-18232 · affects up to 1.5.7 · reported by WPScanMedium 5.3
- Sep 15, 2026WP Directory Kit: Does not sanitize and escape some widget settings before using them in a SQL statementCVE-2026-16593 · affects up to 1.5.7 · reported by WPScanMedium 6.8
- Sep 15, 2026WP Directory Kit: Does not check authorization or listing visibility in one of its shortcodesCVE-2026-16592 · affects up to 1.5.7 · reported by WPScanLow 2.7
- Aug 19, 2026WP Directory Kit: Does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rowsCVE-2026-18231 · fixed in 1.5.7 · reported by WPScanMedium 5.3
- Aug 16, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-18653 · fixed in 1.5.7 · reported by WPScanHigh 7.2
- Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-28001 · affects up to 1.5.4 · reported by PatchstackCritical 9.3
- Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-27538 · affects up to 1.5.4 · reported by PatchstackHigh 7.5
- Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-18474 · fixed in 1.5.6 · reported by WPScanHigh 8.6
- Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-18230 · fixed in 1.5.6 · reported by WPScanHigh 8.1
- Aug 9, 2026WP Directory Kit: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-18473 · fixed in 1.5.5 · reported by WPScanCritical 9.1
- Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16595 · fixed in 1.5.5 · reported by WPScanMedium 6.5
- Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16594 · fixed in 1.5.5 · reported by WPScanHigh 7.5
- Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16590 · fixed in 1.5.5 · reported by WPScanMedium 6.5
- Aug 8, 2026WP Directory Kit: Does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-16589 · fixed in 1.5.5 · reported by WPScanHigh 7.7
- Jun 15, 2026Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.CVE-2026-39534 · affects up to 1.5.0 · reported by PatchstackHigh 7.5
- Jun 1, 2026WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42672 · affects up to 1.5.1 · reported by PatchstackCritical 9.3
- May 21, 2026WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39531 · affects up to 1.5.0 · reported by PatchstackCritical 9.3
- Jan 24, 2026WP Directory Kit: Sensitive Information ExposureCVE-2025-13920 · affects up to 1.4.9 · reported by WordfenceMedium 5.3
- Dec 13, 2025WP Directory Kit: SQL InjectionCVE-2025-13089 · affects up to 1.4.7 · reported by WordfenceHigh 7.5
- Dec 3, 2025WP Directory Kit: Authentication bypassCVE-2025-13390 · affects up to 1.4.4 · reported by Wordfence4.6% oddsCritical 10
- Dec 2, 2025WP Directory Kit: SQL InjectionCVE-2025-13090 · affects up to 1.4.6 · reported by WordfenceMedium 4.9
- Nov 27, 2025WP Directory Kit: Reflected Cross-Site ScriptingCVE-2025-13525 · affects up to 1.4.5 · reported by WordfenceMedium 6.1
- Nov 21, 2025WP Directory Kit: SQL InjectionCVE-2025-13138 · affects up to 1.4.3 · reported by Wordfence1.6% oddsHigh 7.5
- Sep 26, 2025WP Directory Kit: Missing AuthorizationCVE-2025-60120 · affects up to 1.4.0 · reported by PatchstackMedium 5.3
- Dec 13, 2024WP Directory Kit: Missing AuthorizationCVE-2023-41875 · affects up to 1.2.6 · reported by PatchstackMedium 5.3
- Jul 21, 2024WP Directory Kit: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37487 · affects up to 1.3.5 · reported by PatchstackHigh 7.1
- Jul 9, 2024WP Directory Kit: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')CVE-2024-37253 · affects up to 1.3.6 · reported by PatchstackLow 2.7
- Apr 5, 2024WP Directory Kit: SQL InjectionCVE-2024-3217 · affects up to 1.3.0 · reported by Wordfence1.9% oddsHigh 8.8
- Mar 27, 2024WP Directory Kit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29774 · affects up to 1.2.9 · reported by PatchstackHigh 7.1
- Dec 29, 2023WP Directory Kit: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-31229 · affects up to 1.1.9 · reported by PatchstackMedium 4.7
- Aug 31, 2023WP Directory Kit: Cross-Site Request ForgeryCVE-2023-2279 · affects up to 1.2.1 · reported by WordfenceMedium 5.4
- Jun 12, 2023WP Directory Kit: Unauthorized modification of data and loss of dataCVE-2023-2351 · affects up to 1.2.3 · reported by WordfenceMedium 6.5
- Jun 12, 2023WP Directory Kit: Local File InclusionCVE-2023-2278 · affects up to 1.1.9 · reported by Wordfence1.7% oddsCritical 9.8
- Jun 12, 2023WP Directory Kit: Cross-Site Request ForgeryCVE-2023-2277 · affects up to 1.1.9 · reported by WordfenceMedium 6.1
- Jun 9, 2023WP Directory Kit: Unauthorized modification of data and loss of dataCVE-2023-2280 · affects up to 1.2.2 · reported by WordfenceMedium 6.5
- Jun 2, 2023WP Directory Kit: Reflected Cross-Site ScriptingCVE-2023-2835 · affects up to 1.2.3 · reported by WordfenceMedium 6.1
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.