wpdirectorykit records

13 published records for vendor wpdirectorykit.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 38.5%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

13 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2025-13390Proof of concept	WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeoverwpdirectorykit · wp directory kit · CWE-303 Pre-auth Auth bypass	Critical9.8	—	4.6%	Dec 3, 2025
40Plan	CVE-2023-2278No exploit	WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_actionwpdirectorykit · wp directory kit · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	1.7%	Jun 12, 2023
39Monitor	CVE-2023-41875No exploit	WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerabilitywpdirectorykit · wp directory kit · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.8%	Dec 13, 2024
36Monitor	CVE-2024-3217Proof of concept	WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injectionwpdirectorykit · wp directory kit · CWE-89 SQL injection	High8.8	—	1.9%	Apr 5, 2024
24Monitor	CVE-2023-2835No exploit	WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'wpdirectorykit · wp directory kit · CWE-79 Pre-auth XSS	Medium6.1	—	0.7%	Jun 2, 2023
24Monitor	CVE-2024-29774No exploit	WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilitywpdirectorykit · wp directory kit · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Mar 27, 2024
24Monitor	CVE-2024-37487No exploit	WordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilitywpdirectorykit · wp directory kit · CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	Jul 21, 2024
24Monitor	CVE-2023-31229No exploit	WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirectionwpdirectorykit · wp directory kit · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.3%	Dec 29, 2023
21Monitor	CVE-2023-2280No exploit	WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_actionwpdirectorykit · wp directory kit · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.6%	Jun 9, 2023
21Monitor	CVE-2023-2279No exploit	WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_displaywpdirectorykit · wp directory kit · CWE-352 Pre-auth CSRF	Medium5.4	—	0.3%	Aug 31, 2023
18Monitor	CVE-2023-2277No exploit	WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitemwpdirectorykit · wp directory kit · CWE-352 Pre-auth XSS CSRF	Medium4.7	—	0.3%	Jun 12, 2023
17Monitor	CVE-2023-2351No exploit	WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_actionwpdirectorykit · wp directory kit · CWE-862 Broken access control (IDOR)	Medium4.3	—	0.6%	Jun 12, 2023
10Monitor	CVE-2024-37253No exploit	WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerabilitywpdirectorykit · wp directory kit · CWE-74 RCE	Low2.7	—	0.3%	Jul 9, 2024

CVE-2025-13390
40Plan
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
CriticalCVSS 9.8Proof of conceptEPSS 5%
- Pre-auth
- Auth bypass
wpdirectorykit · wp directory kitDec 3, 2025
CVE-2023-2278
40Plan
WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Path traversal
wpdirectorykit · wp directory kitJun 12, 2023
CVE-2023-41875
39Monitor
WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
wpdirectorykit · wp directory kitDec 13, 2024
CVE-2024-3217
36Monitor
WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection
HighCVSS 8.8Proof of conceptEPSS 2%
- SQL injection
wpdirectorykit · wp directory kitApr 5, 2024
CVE-2023-2835
24Monitor
WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
wpdirectorykit · wp directory kitJun 2, 2023
CVE-2024-29774
24Monitor
WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
wpdirectorykit · wp directory kitMar 27, 2024
CVE-2024-37487
24Monitor
WordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
wpdirectorykit · wp directory kitJul 21, 2024
CVE-2023-31229
24Monitor
WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- Open redirect
wpdirectorykit · wp directory kitDec 29, 2023
CVE-2023-2280
21Monitor
WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
wpdirectorykit · wp directory kitJun 9, 2023
CVE-2023-2279
21Monitor
WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display
MediumCVSS 5.4No exploitEPSS 0%
- Pre-auth
- CSRF
wpdirectorykit · wp directory kitAug 31, 2023
CVE-2023-2277
18Monitor
WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem
MediumCVSS 4.7No exploitEPSS 0%
wpdirectorykit · wp directory kitJun 12, 2023
CVE-2023-2351
17Monitor
WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action
MediumCVSS 4.3No exploitEPSS 1%
- Broken access control (IDOR)
wpdirectorykit · wp directory kitJun 12, 2023
CVE-2024-37253
10Monitor
WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability
LowCVSS 2.7No exploitEPSS 0%
- RCE
wpdirectorykit · wp directory kitJul 9, 2024