CVE-2026-18232

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

CVE-2026-18232 WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File

The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible printphpinformation.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PH...

CVE-2024-6529

WordPress 插件漏洞的概念验证 PoC 此仓库包含针对在不同 WordPress 插件中发现的各种漏洞的概念验证 PoC 脚本。这些脚本展示了攻击者如何利用这些漏洞执行恶意操作。 目录 涵盖的漏洞 设置与使用 Ultimate Classified Listings 插件中的反射型 XSS 利用 XSS 窃取 Cookie 重要注意事项 涵盖的漏洞 1. Ultimate Classified Listings 插件中的反射型跨站脚本 XSS Ultimate Classified Listings WordPress 插件 1.4...

Dark_Ledger

暗黑账本 本仓库作为暗网市场信息的存档，包括： 供应商列表 供应商 PGP 密钥 商品列表及描述 市场结构及其他相关数据 CDN 如果你想从 Gwern.net 下载 “暗网市场档案” ，但发现现有选项（rsync 和 torrent）速度太慢，你可以直接从我的 CDN 下载： 🔗 DarkWebInformer CDN 这提供了比 Gwern 的选项更快、更可靠的替代方案。 目的 本项目旨在保存暗网市场数据，用于研究、情报收集和历史参考。所有数据均来自公开来源，仅供信息参考之用。 免责声明 本仓库仅用于教育和研究目的。不提倡任何非法活动。请负责任地使用这些信息。 贡献...

Astra Linux – Vulnerability in Firefox and Thunderbird

When accessing directory listings for chrome:// URLs as source text, certain parameters are reflected. This vulnerability affects Firefox ESR 102.1, Firefox ESR 91.12, Firefox 103, Thunderbird 102.1, and Thunderbird 91.12...

CVE-2026-28142

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

PT-2026-71511

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-19074

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-19074

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

EUVD-2026-54998

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-16988

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

CVE-2026-16988

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

CVE-2026-16988

The available details confirm CVE-2026-16988 affects the GeoDirectory WordPress plugin (versions before 2.8.169). The root cause is an missing authorization check when returning map marker data for a single listing via the markers REST endpoint, allowing unauthenticated users to disclose the titl...

CVE-2026-16988 GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

EUVD-2026-54890

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

EUVD-2026-54741

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...

CVE-2026-16595

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...

CVE-2026-16595 WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...

CVE-2026-16595

The WP Directory Kit WordPress plugin is affected (versions before 1.5.5). Affected component: the plugin’s authenticated AJAX action. Root cause: missing authorization/nonce checks, enabling any authenticated user (e.g., a Subscriber) to disclose the site’s user list and unpublished listings bel...