Business Directory Plugin <= 6.4.2 - SQL Injection

The Business Directory Plugin Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-4443-Poc

CVE-2024-4443-Poc CVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress execute \business-directory-plugin\includes\helpers\class-listing-search.php:88 WPBDPListingSearch-traversetree \business-directory-plugin\includes\helpers\class-listing-search.php:185...

CVE-2026-111069

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This...

CVE-2026-109193

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-109388

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-102791

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-53580

CVE-2025-53580 WordPress Simple Business Directory Pro Plugin 15.6.9 is vulnerable to a high priority Privilege Escalation CVE-2025-53580 Simple Business Directory Pro — Incorrect Privilege Assignment → Password Reset → Admin Takeover / | |// / / / | | / | / \ / \ | | | \ /| | / | | /| /| | | |...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin HivePress versions = 1.7.32...

CVE_2026_2576_PoC

CVE-2026-2576 — Business Directory Plugin SQLi PoC Unauthenticated Time-Based Blind SQL Injection Business Directory Plugin for WordPress ≤ 6.4.21 Table of Contents Vulnerability Overview Technical Analysis Lab Requirements Lab Setup Running the PoC Expected Output Patch Analysis References...

CVE-2026-107754

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.8.190 . The root cause is insufficient input sanitization and output escaping within the post_images (file_i...

EUVD-2026-100899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postimages fileinfo2 = title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output...

CVE-2026-100185

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-100185

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 8.10.2.1 . The root cause is insufficient input sanitization and output escaping within the 'phone' Listing Field ....

CVE-2026-17092 Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-17092

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 8.10.2.1 . The root cause is a failure to properly verify user permissions when performing certain actions. Consequently, an ...

PT-2026-113612

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-107657

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104722

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...

CVE-2026-104722 Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...

EUVD-2026-96299

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSDMenusIXCSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticate...