Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 40

Reset filters

Medium 09.10.2026

CVE-2026-96653

WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) Second-Order SQL Injection via 'display_name'

WP Directory Kit for WordPress is vulnerable to second-order SQL injection through the display_name profile field. Authenticated users with subscriber-level privileges or higher can extract sensitive database information.

Medium 29.09.2026

CVE-2026-16596

WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter

Medium 24.09.2026

CVE-2026-16591

Directory Kit <= 1.5.7 - Authenticated (Listing Admin+) Stored Cross-Site Scripting

Medium 15.09.2026

CVE-2026-16588

WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter

Medium 12.09.2026

CVE-2026-18232

Directory Kit <= 1.5.7 - Unauthenticated Information Exposure

Medium 12.09.2026

CVE-2026-16592

Directory Kit <= 1.5.7 - Authenticated (Contributor+) Information Exposure

Medium 12.09.2026

CVE-2026-16593

Directory Kit <= 1.5.7 - Authenticated (Editor+) SQL Injection

Medium 21.08.2026

CVE-2026-18231

WP Directory Kit < 1.5.7 - Unauthenticated Information Exposure

Medium 20.08.2026

CVE-2026-18653

WP Directory Kit < 1.5.7 - Authenticated (Administrator+) SQL Injection

High 12.08.2026

CVE-2026-28001

Directory Kit <= 1.5.4 - Unauthenticated SQL Injection

Medium 11.08.2026

CVE-2026-27538

WP Directory Kit <= 1.5.4 - Unauthenticated SQL Injection

Medium 10.08.2026

CVE-2026-18230

Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection

High 10.08.2026

CVE-2026-18474

Directory Kit <= 1.5.5 - Unauthenticated SQL Injection

High 03.08.2026

CVE-2026-18473

Directory Kit <= 1.5.4 - Unauthenticated SQL Injection

Medium 03.08.2026

CVE-2026-16590

Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Contact Message and User Data Disclosure

Medium 03.08.2026

CVE-2026-16589

Directory Kit <= 1.5.4 - Authenticated (Subscriber+) SQL Injection

Medium 03.08.2026

CVE-2026-16595

Directory Kit <= 1.5.4 - Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure

Medium 03.08.2026

CVE-2026-16594

Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Plugin Settings and API Key Disclosure

High 14.05.2026

CVE-2026-42672

WP Directory Kit <= 1.5.1 - Unauthenticated SQL Injection

High 13.04.2026

CVE-2026-39531

WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection

Medium 08.04.2026

CVE-2026-39534

WP Directory Kit <= 1.5.0 - Missing Authorization

Medium 23.01.2026

CVE-2025-13920

WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

High 12.12.2025

CVE-2025-13089

WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection

Critical 03.12.2025

CVE-2025-13390

WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

Showing 1 to 24 of 40 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 40

Know which vulnerabilities affect your application

Application security in your inbox