wpdirectorykit vulnerabilities

CVEs per yearBy the year they were published

1. 20236
2. 20243
3. 20257
4. 20267

Newest CVEs

• CVE-2026-109197

  WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

  wpdirectorykit · WP Directory Kit

  High7.5
• CVE-2026-96653

  WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)

  wpdirectorykit · WP Directory Kit

  Medium6.5
• CVE-2026-16596

  WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter

  wpdirectorykit · WP Directory Kit

  Medium6.5
• CVE-2026-16588

  WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter

  wpdirectorykit · WP Directory Kit

  Medium6.5
• CVE-2026-28001

  WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

  WPDirectoryKit · WP Directory Kit

  Critical9.3
• CVE-2026-27538

  WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

  WPDirectoryKit · WP Directory Kit

  High7.5
• CVE-2025-13920

  WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

  wpdirectorykit · WP Directory Kit

  Medium5.3
• CVE-2025-14618

  Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion

  wpdirectorykit · Sweet Energy Efficiency

  Medium4.3
• CVE-2025-13089

  WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection

  wpdirectorykit · WP Directory Kit

  High7.5
• CVE-2025-13090

  WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection

  wpdirectorykit · WP Directory Kit

  Medium4.9