Skip to content
Noroxi

Directorist: AI-Powered Business Directory, Listings & Classified Ads

directorist · plugin

Known security vulnerabilities for Directorist: AI-Powered Business Directory, Listings & Classified Ads. Find out in seconds which version runs on your site with WP Lens.

16 known vulnerabilities

2 critical · 8 exploitable without logging in · latest Jul 13, 2026

Listed on wordpress.org · latest 8.10 · last updated Oct 1, 2026 · 20K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

  • CVE-2026-59518unauthenticated≤ 8.8.2

    WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability

    Critical 9.8

  • CVE-2025-1570unauthenticated≤ 8.1

    Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP

    Critical 9.8

  • CVE-2023-1888subscriber+≤ 7.5.4

    Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation

    High 8.8

  • CVE-2023-41798high privilege≤ 7.7.1

    WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection

    High 8.8

  • CVE-2025-10488subscriber+≤ 8.4.8

    Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move

    High 8.1

  • CVE-2025-68069login required≤ 8.6.6

    WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability

    High 7.1

  • CVE-2025-12174subscriber+≤ 8.5.2

    Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and S

    Medium 6.5

  • CVE-2023-1889subscriber+≤ 7.5.4

    Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task

    Medium 6.5

  • CVE-2026-39509unauthenticated≤ 8.5.10

    WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2025-2224unauthenticated≤ 8.2

    Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing

    Medium 5.3

  • CVE-2024-12041unauthenticated≤ 8.0.12

    Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure

    Medium 5.3

  • CVE-2024-33929unauthenticated≤ 7.8.6

    WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2024-1322unauthenticated≤ 7.8.4

    Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change

    Medium 5.3

  • CVE-2022-2046admin→ 7.2.3

    Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload

    Medium 4.9

  • CVE-2025-64250unauthenticated · needs a click≤ 8.6.6

    WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability

    Medium 4.7

  • CVE-2023-35052login required≤ 7.5.4

    WordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerability

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory