Skip to content
Unknown Directory vulnerabilities
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR
CVE-2026-118534
4.3 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt
CVE-2026-118533
4.3 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field
CVE-2026-118532
6.5 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action
CVE-2026-118530
5.0 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout
CVE-2026-118529
3.1 Low
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR
CVE-2026-118528
4.3 Medium
-
unknown dt directory lite addon
DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update
CVE-2026-105993
5.3 Medium
-
paolo geodirectory
GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure
CVE-2026-114270
5.3 Medium
-
paolo geodirectory
GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
CVE-2026-113494
2.7 Low
-
paolo geodirectory
GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute
CVE-2026-113488
6.8 Medium
-
paolo geodirectory
GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute
CVE-2026-113487
6.8 Medium
-
paolo geodirectory
GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
CVE-2026-113674
3.7 Low
-
paolo geodirectory
GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
CVE-2026-113673
7.2 High
-
paolo geodirectory
GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
CVE-2026-113493
6.8 Medium
-
paolo geodirectory
GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action
CVE-2026-113492
5.3 Medium
-
paolo geodirectory
GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
CVE-2026-113491
6.4 Medium
-
paolo geodirectory
GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
CVE-2026-113490
5.3 Medium
-
paolo geodirectory
GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
CVE-2026-113489
4.3 Medium
-
cmsjunkie - wordpress business directory plugins wp-businessdirectory
WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
CVE-2026-89271
5.3 Medium
-
shazahm1hotmailcom connections business directory
Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes
CVE-2026-86789
5.3 Medium
-
unknown wp directory kit
WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields
CVE-2026-16591
7.2 High
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
CVE-2026-84150
5.4 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing
CVE-2026-84098
6.5 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL
CVE-2026-84046
5.0 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint
CVE-2026-84027
4.3 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint
CVE-2026-84026
5.3 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint
CVE-2026-77766
4.3 Medium
-
unknown wp directory kit
WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow
CVE-2026-18232
5.3 Medium
-
unknown wp directory kit
WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings
CVE-2026-16593
6.8 Medium
-
unknown wp directory kit
WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes
CVE-2026-16592
2.7 Low
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
CVE-2026-84066
3.1 Low
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission
CVE-2026-77757
5.4 Medium
-
unknown wp directory kit
WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user
CVE-2026-18231
5.3 Medium
-
unknown wp directory kit
WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter
CVE-2026-18653
7.2 High
-
unknown wp directory kit
WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category
CVE-2026-18474
8.6 High
-
unknown wp directory kit
WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter
CVE-2026-18230
8.1 High
-
pluginsware advanced classifieds & directory pro
Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure
CVE-2026-19074
5.3 Medium
-
unknown wp directory kit
WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter
CVE-2026-18473
9.1 Critical
-
paolo geodirectory
GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint
CVE-2026-16988
7.5 High
-
unknown wp directory kit
WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
CVE-2026-16595
6.5 Medium
-
unknown wp directory kit
WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
CVE-2026-16594
7.5 High
-
unknown wp directory kit
WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
CVE-2026-16590
6.5 Medium
-
unknown wp directory kit
WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter
CVE-2026-16589
7.7 High
-
paolo geodirectory
GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories
CVE-2025-15677
3.5 Low
-
paolo geodirectory
GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users
CVE-2026-16968
6.5 Medium
-
unknown user frontend: ai powered frontend post submission, user directory, user profile, membership & user registration
WP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion
CVE-2026-14568
6.5 Medium
-
ayecode geodirectory
GeoDirectory < 2.8.120 - Contributor+ Stored XSS
CVE-2025-6200
5.9 Medium
-
quantumcloud simple video directory
Simple Video Directory < 1.4.3 - Unauthenticated SQLi
CVE-2024-6809
9.8 Critical
-
salephpscripts web directory free
Web Directory Free < 1.7.3 - Unauthenticated LFI
CVE-2024-3673
Public exploit
9.1 Critical
-
salephpscripts web directory free
Web Directory Free < 1.7.2 - Reflected XSS
CVE-2024-3669
6.8 Medium
- Show olderLoading…