Skip to contentWpwax Directorist vulnerabilities
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status UpdateCVE-2026-1185313.1 Low
- wpwax directoristWordPress Directorist plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1226616.5 Medium
- wpwax directoristWordPress Directorist plugin <= 8.10.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1194976.5 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDORCVE-2026-1185344.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment ReceiptCVE-2026-1185334.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image FieldCVE-2026-1185326.5 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk ActionCVE-2026-1185305.0 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing CheckoutCVE-2026-1185293.1 Low
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDORCVE-2026-1185284.3 Medium
- wpwax directorist: ai-powered business directory, listings & classified adsDirectorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing FieldCVE-2026-1001856.4 Medium
- wpwax directorist: ai-powered business directory, listings & classified adsDirectorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' ParameterCVE-2026-170928.1 High
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites EndpointCVE-2026-841505.4 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listingCVE-2026-840986.5 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.9.5 - Subscriber+ SSRF via Avatar URLCVE-2026-840465.0 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders EndpointCVE-2026-840274.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users EndpointCVE-2026-840265.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders EndpointCVE-2026-777664.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_uploadCVE-2026-840663.1 Low
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing SubmissionCVE-2026-777575.4 Medium
- wpwax directoristWordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerabilityCVE-2026-595189.8 Critical
- directorist booking booking, wpwax directorist booking +1 moreWordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerabilityCVE-2026-490738.5 High
- wpwax directoristWordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerabilityCVE-2026-395095.3 Medium
- wpwax directoristWordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerabilityCVE-2025-680697.1 High
- wpwax directoristWordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerabilityCVE-2025-642504.7 Medium
- wpwax directorist: ai-powered business directory, listings & classified adsDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug UpdateCVE-2025-121746.5 Medium
- wpwax directorist: ai-powered business directory, listings & classified adsDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File MoveCVE-2025-104888.1 High
- wpwax directorist addonskit for elementorWordPress Directorist AddonsKit for Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-318576.5 Medium
- wpwax directorist: ai-powered business directory, listings & classified adsDirectorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post PublishingCVE-2025-22245.3 Medium
- wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 moreDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTPCVE-2025-15708.1 High
- wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 moreDirectorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information ExposureCVE-2024-120415.3 Medium
- wpwax directoristWordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerabilityCVE-2023-350524.3 Medium
- wordpress directoristWordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerabilityCVE-2024-339295.3 Medium
- wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 moreDirectorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings ChangeCVE-2024-13225.3 Medium
- unknown directoristDirectorist < 7.5.4 - Admin+ LFICVE-2023-22522.7 Low
- wpwax directorist, directorist – wordpress business directory plugin with classified ads listings +1 moreWordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV InjectionCVE-2023-417985.1 Medium
- wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 moreDirectorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_taskCVE-2023-18896.5 Medium
- wpwax directorist, directorist: ai-powered business directory, listings & classified ads +1 moreDirectorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege EscalationCVE-2023-18888.8 High
- unknown directoristDirectorist < 7.4.4 - Subscriber+ Sensitive Information DisclosureCVE-2022-39616.5 Medium
- unknown directoristDirectorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDORCVE-2022-39306.5 Medium
- wpwax directorist, unknown directorist – wordpress business directory plugin with classified ads listings +1 moreDirectorist < 7.3.1 - Unauthenticated Email Address DisclosureCVE-2022-23765.3 Medium
- wpwax directorist, unknown directorist – wordpress business directory plugin with classified ads listings +1 moreDirectorist < 7.3.0 - Subscriber+ Arbitrary E-mail SendingCVE-2022-23774.3 Medium
- wpwax directorist, unknown directorist – wordpress business directory plugin with classified ads listings +1 moreDirectorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File UploadCVE-2022-20464.9 Medium
- unknown directorist – business directory plugin, wpwax directorist +1 moreDirectorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File UploadCVE-2021-249817.5 High