CVE-2026-16592 WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users...

WordPress WP Directory Kit plugin <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure vulnerability

Unauthenticated Unpublished Listing Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions = 1.5.7...

WordPress WP Directory Kit plugin <= 1.5.7 - Editor+ SQL Injection vulnerability

Editor+ SQL Injection vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions = 1.5.7...

CVE-2026-16593

The WP Directory Kit WordPress plugin (versions through 1.5.7 ) is vulnerable to SQL injection due to a lack of proper sanitization and escaping of certain widget settings. Specifically, the Elementor Category and Location Widget Settings are processed in a SQL statement without sufficient valida...

PT-2026-91867

Name of the Vulnerable Software and Affected Versions WP Directory Kit WordPress plugin versions prior to 1.5.8 Description The plugin fails to verify the status or ownership of a listing before returning its content via a public AJAX action. This allows unauthenticated attackers to access and re...

PT-2026-91865

Name of the Vulnerable Software and Affected Versions WP Directory Kit WordPress plugin versions prior to 1.5.8 Description An authorization and visibility check failure in a shortcode allows users with Contributor privileges to disclose non-public listing content. This includes access to hidden...

CVE-2026-89027: Missing Authentication for Critical Function

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

CVE-2026-18232: Exposure of Sensitive Information to an Unauthorized Actor

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

CVE-2026-16593: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder Editor and above to perform SQL injection attacks that execute when the affected page is rendere...

CVE-2026-16592: Exposure of Sensitive Information to an Unauthorized Actor

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users...

PT-2026-91866

Name of the Vulnerable Software and Affected Versions WP Directory Kit WordPress plugin versions prior to 1.5.8 Description Authenticated users with Editor privileges or higher can perform SQL injection attacks. The issue occurs because certain widget settings are not properly sanitized or escape...

WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sorawautsukushiii in WordPress Plugin WP Inventory Manager versions = 2.5.4...

WordPress Yogeta WP Cloud plugin <= 1.0 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by Huynh Kien Minh in WordPress Plugin Yogeta WP Cloud versions = 1.0...

WordPress WP Component plugin <= 2.2.4 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin WP Component versions = 2.2.4...

CVE-2026-85200

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

EUVD-2026-76829

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2026-85200

GEO my WP is a WordPress plugin vulnerable to an unauthenticated Local File Inclusion (LFI) in all versions up to and including 4.5.5.3 , via the gmw_posts_locator_ajax_info_window_loader function. An attacker can include and execute arbitrary .php files on the server, enabling bypass of access c...

CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...