CVE-2026-86789

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-86789 Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-86789

The Connections Business Directory WordPress plugin, in versions up to and including 10.4.67 , fails to enforce visibility and moderation-status restrictions on specific REST API read endpoints (specifically cn-api/v1 routes). This flaw allows unauthenticated attackers to retrieve sensitive infor...

EUVD-2026-89629

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-86789 Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

WordPress Connections Business Directory plugin <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure vulnerability

Unauthenticated Non-Public Directory Entry Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Connections Business Directory versions = 10.4.67...

PT-2026-103032

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-86789: Exposure of Sensitive Information to an Unauthorized Actor

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

EUVD-2016-0786

Malware in sbrugna...

EUVD-2023-33006

Malicious code in bioql PyPI...

CVE-2023-29437

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Steven A. Zahm Connections Business Directory plugin = 10.4.36 versions...

CVE-2024-12885 Connections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion

The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with...

CVE-2024-12885 Connections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion

The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with...

WordPress plugin Connections Business Directory 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2024-12885: Improper Limitation of a Pathname to a Restricted Directory

The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with...

CVE-2023-29437

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Steven A. Zahm Connections Business Directory plugin = 10.4.36 versions...

CVE-2023-29437 WordPress Connections Business Directory Plugin <= 10.4.36 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Steven A. Zahm Connections Business Directory plugin = 10.4.36 versions...

CVE-2023-29437

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Steven A. Zahm Connections Business Directory plugin = 10.4.36 versions...

CVE-2023-29437

The CVE-2023-29437 entry corresponds to a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Connections Business Directory plugin, affecting versions 10.4.36, specifically 10.4.37 or later. Patch sources indicate a low-severity issue with low likelihood of exploitation. No exploit...

PT-2023-22261 · WordPress · Steven A. Zahm Connections Business Directory

Name of the Vulnerable Software and Affected Versions: Steven A. Zahm Connections Business Directory plugin versions = 10.4.36 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. Recommendations: For Steve...