Skip to content
Noroxi

WP Directory Kit

wpdirectorykit · plugin

Known security vulnerabilities for WP Directory Kit. Find out in seconds which version runs on your site with WP Lens.

24 known vulnerabilities

6 critical · 20 exploitable without logging in · 5 with public exploit code · latest Aug 13, 2026

Listed on wordpress.org · latest 1.5.9 · last updated Sep 23, 2026 · 2K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-13390unauthenticated≤ 1.4.4

    WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

    Critical 9.8

  • CVE-2023-41875unauthenticated≤ 1.2.6

    WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability

    Critical 9.8

  • CVE-2023-2278unauthenticated≤ 1.1.9

    WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action

    Critical 9.8

  • CVE-2026-28001unauthenticated≤ 1.5.4

    WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

    Critical 9.3

  • CVE-2026-42672unauthenticated≤ 1.5.1

    WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability

    Critical 9.3

  • CVE-2026-39531unauthenticated≤ 1.5.0

    WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability

    Critical 9.3

  • CVE-2024-3217subscriber+≤ 1.3.0

    WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection

    High 8.8

  • CVE-2026-27538unauthenticated≤ 1.5.4

    WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

    High 7.5

  • CVE-2026-39534unauthenticated≤ 1.5.0

    WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability

    High 7.5

  • CVE-2025-13089unauthenticated≤ 1.4.7

    WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection

    High 7.5

  • CVE-2025-13138unauthenticated≤ 1.4.3

    WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function

    High 7.5

  • CVE-2025-13525unauthenticated · needs a click≤ 1.4.5

    WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter

    Medium 6.1

  • CVE-2024-37487unauthenticated · needs a click≤ 1.3.5

    WordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2024-29774unauthenticated · needs a click≤ 1.2.9

    WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2023-31229unauthenticated · needs a click≤ 1.1.9

    WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection

    Medium 6.1

  • CVE-2023-2835unauthenticated · needs a click≤ 1.2.3

    WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'

    Medium 6.1

  • CVE-2023-2279unauthenticated · needs a click≤ 1.2.1

    WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display

    Medium 5.4

  • CVE-2025-13920unauthenticated≤ 1.4.9

    WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

    Medium 5.3

  • CVE-2025-60120unauthenticated≤ 1.4.0

    WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2023-2280unauthenticated≤ 1.2.2

    WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action

    Medium 5.3

  • CVE-2025-13090admin≤ 1.4.6

    WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection

    Medium 4.9

  • CVE-2023-2277unauthenticated · needs a click≤ 1.1.9

    WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem

    Medium 4.7

  • CVE-2023-2351subscriber+≤ 1.2.3

    WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action

    Medium 4.3

  • CVE-2024-37253high privilege≤ 1.3.6

    WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability

    Low 2.7

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory