WP Directory Kit

Уязвимости

• CVE-2025-13390без авторизации≤ 1.4.4

  WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

  Критич. 9.8

• CVE-2023-41875без авторизации≤ 1.2.6

  WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability

  Критич. 9.8

• CVE-2023-2278без авторизации≤ 1.1.9

  WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action

  Критич. 9.8

• CVE-2026-28001без авторизации≤ 1.5.4

  WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2026-42672без авторизации≤ 1.5.1

  WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2026-39531без авторизации≤ 1.5.0

  WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2024-3217подписчик+≤ 1.3.0

  WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection

  Высокий 8.8

• CVE-2026-27538без авторизации≤ 1.5.4

  WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

  Высокий 7.5

• CVE-2026-39534без авторизации≤ 1.5.0

  WordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerability

  Высокий 7.5

• CVE-2025-13089без авторизации≤ 1.4.7

  WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection

  Высокий 7.5

• CVE-2025-13138без авторизации≤ 1.4.3

  WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function

  Высокий 7.5

• CVE-2025-13525без авторизации · нужен клик≤ 1.4.5

  WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter

  Средний 6.1

• CVE-2024-37487без авторизации · нужен клик≤ 1.3.5

  WordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

  Средний 6.1

• CVE-2024-29774без авторизации · нужен клик≤ 1.2.9

  WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

  Средний 6.1

• CVE-2023-31229без авторизации · нужен клик≤ 1.1.9

  WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection

  Средний 6.1

• CVE-2023-2835без авторизации · нужен клик≤ 1.2.3

  WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'

  Средний 6.1

• CVE-2023-2279без авторизации · нужен клик≤ 1.2.1

  WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display

  Средний 5.4

• CVE-2025-13920без авторизации≤ 1.4.9

  WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

  Средний 5.3

• CVE-2025-60120без авторизации≤ 1.4.0

  WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2023-2280без авторизации≤ 1.2.2

  WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action

  Средний 5.3

• CVE-2025-13090админ≤ 1.4.6

  WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection

  Средний 4.9

• CVE-2023-2277без авторизации · нужен клик≤ 1.1.9

  WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem

  Средний 4.7

• CVE-2023-2351подписчик+≤ 1.2.3

  WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action

  Средний 4.3

• CVE-2024-37253высокие права≤ 1.3.6

  WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability

  Низкий 2.7