Directorist < 7.5.4 - Local File Inclusion

Directorist before 7.5.4 is susceptible to Local File Inclusion as it does not validate the file parameter when importing CSV files. id: CVE-2023-2252 info: name: Directorist 7.5.4 - Local File Inclusion author: r3Y3r53 severity: low description: | Directorist before 7.5.4 is susceptible to Local...

WordPress Directorist <7.3.1 - Information Disclosure

WordPress Directorist plugin before 7.3.1 is susceptible to information disclosure. The plugin discloses the email address of all users in an AJAX action available to both unauthenticated and authenticated users. id: CVE-2022-2376 info: name: WordPress Directorist 7.3.1 - Information Disclosure...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.11 - Subscriber+ Arbitrary Media Deletion vulnerability

Subscriber+ Arbitrary Media Deletion vulnerability discovered by Jashid Sany in WordPress Plugin Directorist versions 8.11...

CVE-2026-118532

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media...

CVE-2026-118528

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above t...

CVE-2026-118534

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt...

CVE-2026-118533

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information...

CVE-2026-118530

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out use...

CVE-2026-118529

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's...

EUVD-2026-118939

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt...

CVE-2026-118534

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions before 8.11 . The plugin fails to verify that the order targeted by its checkout payment-retry REST action actually belongs to th...

CVE-2026-118534 Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.11 - Subscriber+ Payment Retry on Other Users' Orders vulnerability

Subscriber+ Payment Retry on Other Users' Orders vulnerability discovered by ilqar rahimli in WordPress Plugin Directorist versions 8.11...

CVE-2026-118533 Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information...

CVE-2026-118529

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin, in versions before 8.11 , contains an incorrect authorization vulnerability (CWE-863). The plugin fails to verify if a user owns a specific listing before processing a featured-listing checkout . This allo...

CVE-2026-118532

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin, versions before 8.11 , is vulnerable to arbitrary media deletion. The root cause is a failure to verify ownership of attachment IDs provided when updating a listing's images. This allows authenticated user...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.11 - Subscriber+ Other Users' Pending Listing Publication vulnerability

Subscriber+ Other Users' Pending Listing Publication vulnerability discovered by GivMeInJ in WordPress Plugin Directorist versions 8.11...

CVE-2026-118530

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin (versions before 8.11 ) is vulnerable to a cross-site account lockout issue. The flaw occurs because the plugin fails to verify if the acting user has permission to edit targeted users during an email-verif...

CVE-2026-118528 Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above t...

CVE-2026-118529 Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's...