wpdirectorykit WP Directory Kit vulnerabilities

CVEs per yearBy the year they were published

1. 20236
2. 20243
3. 20255
4. 20267

Newest CVEs

• CVE-2026-109197

  WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

  wpdirectorykit · WP Directory Kit

  High7.5
• CVE-2026-96653

  WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)

  wpdirectorykit · WP Directory Kit

  Medium6.5
• CVE-2026-16596

  WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter

  wpdirectorykit · WP Directory Kit

  Medium6.5
• CVE-2026-16588

  WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter

  wpdirectorykit · WP Directory Kit

  Medium6.5
• CVE-2026-28001

  WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

  WPDirectoryKit · WP Directory Kit

  Critical9.3
• CVE-2026-27538

  WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

  WPDirectoryKit · WP Directory Kit

  High7.5
• CVE-2025-13920

  WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

  wpdirectorykit · WP Directory Kit

  Medium5.3
• CVE-2025-13089

  WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection

  wpdirectorykit · WP Directory Kit

  High7.5
• CVE-2025-13090

  WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection

  wpdirectorykit · WP Directory Kit

  Medium4.9
• CVE-2025-13525

  WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter

  wpdirectorykit · WP Directory Kit

  Medium6.1