Skip to content
Wpwax vulnerabilities
Newest
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR
CVE-2026-118534
4.3 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt
CVE-2026-118533
4.3 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field
CVE-2026-118532
6.5 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action
CVE-2026-118530
5.0 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout
CVE-2026-118529
3.1 Low
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR
CVE-2026-118528
4.3 Medium
-
wpwax directorist: ai-powered business directory, listings & classified ads
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
CVE-2026-100185
6.4 Medium
-
wpwax directorist: ai-powered business directory, listings & classified ads
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
CVE-2026-17092
8.1 High
-
wpwax formgent
WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
CVE-2026-94499
7.1 High
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
CVE-2026-84150
5.4 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing
CVE-2026-84098
6.5 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL
CVE-2026-84046
5.0 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint
CVE-2026-84027
4.3 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint
CVE-2026-84026
5.3 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint
CVE-2026-77766
4.3 Medium
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
CVE-2026-84066
3.1 Low
-
unknown directorist: ai-powered business directory, listings & classified ads
Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission
CVE-2026-77757
5.4 Medium
-
unknown post grid, slider & carousel ultimate
Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
CVE-2026-16260
6.8 Medium
-
wpwax templatiq
WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability
CVE-2026-32474
9.9 Critical
-
wpwax formgent – next-gen ai form builder for wordpress with multi-step, quizzes, payments & more
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting
CVE-2025-15028
7.2 High
-
wpwax formgent – next-gen ai form builder for wordpress with multi-step, quizzes, payments & more
FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter
CVE-2026-3141
9.1 Critical
-
wpwax directorist
WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability
CVE-2026-59518
9.8 Critical
-
directorist booking booking, wpwax directorist booking +1 more
WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability
CVE-2026-49073
8.5 High
-
wpwax directorist
WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability
CVE-2026-39509
5.3 Medium
-
wpwax formgent
WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerability
CVE-2026-22460
8.6 High
-
wpwax directorist
WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability
CVE-2025-68069
7.1 High
-
wpwax directorist
WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability
CVE-2025-64250
4.7 Medium
-
wpwax legal pages
WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability
CVE-2025-66077
5.3 Medium
-
wpwax directorist: ai-powered business directory, listings & classified ads
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update
CVE-2025-12174
6.5 Medium
-
wpwax directorist: ai-powered business directory, listings & classified ads
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move
CVE-2025-10488
8.1 High
-
unknown formgent
FormGent < 1.0.4 - Unauthenticated Arbitrary File Deletion
CVE-2025-10916
9.1 Critical
-
wpwax legal pages
WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control Vulnerability
CVE-2025-48242
6.5 Medium
-
wpwax helpgent
WordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerability
CVE-2025-32658
9.8 Critical
-
wpwax logo carousel slider
WordPress Logo Carousel Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability
CVE-2025-39525
6.5 Medium
-
wpwax logo showcase ultimate
WordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability
CVE-2025-32499
6.5 Medium
-
wpwax directorist addonskit for elementor
WordPress Directorist AddonsKit for Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
CVE-2025-31857
6.5 Medium
-
wpwax directorist: ai-powered business directory, listings & classified ads
Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing
CVE-2025-2224
5.3 Medium
-
wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 more
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP
CVE-2025-1570
8.1 High
-
wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 more
Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure
CVE-2024-12041
5.3 Medium
-
wpwax post grid, slider & carousel ultimate, post grid\, slider \& carousel ultimate +1 more
WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerability
CVE-2025-24782
6.5 Medium
-
wpwax product carousel slider & grid ultimate for woocommerce
WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
CVE-2025-24681
5.9 Medium
-
pickplugins post grid, wpwax post grid, slider & carousel ultimate – with shortcode, gutenberg block & elementor widget +1 more
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion
CVE-2024-13408
7.5 High
-
wpwax post grid, slider & carousel ultimate – with shortcode, gutenberg block & elementor widget, post grid\, slider \& carousel ultimate +1 more
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()
CVE-2024-13409
7.5 High
-
wpwax directorist
WordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerability
CVE-2023-35052
4.3 Medium
-
wpwax product carousel slider & grid ultimate for woocommerce
Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'
CVE-2024-12040
8.8 High
-
wpwax product carousel slider & grid ultimate for woocommerce
WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability
CVE-2024-44048
6.5 Medium
-
wpwax logo showcase ultimate – logo carousel, logo slider & logo grid
Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
CVE-2024-8046
6.4 Medium
-
wordpress directorist
WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerability
CVE-2024-33929
5.3 Medium
-
wpwax legal pages
WordPress Legal Pages plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2024-32451
4.3 Medium
-
wpwax post grid, slider & carousel ultimate, post grid\, slider \& carousel ultimate +1 more
WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability
CVE-2024-29925
6.5 Medium
- Show olderLoading…