cve-2024-3552

Descripción El plugin Web Directory Free WordPress anterior a la versión 1.7.0 contiene una vulnerabilidad de inyección SQL. La función de ejecución AJAX no está suficientemente filtrada/saneada, lo que permite a un atacante neutralizar la consulta SQL o inyectar cláusulas adicionales UNION,...

Web Directory Free < 1.7.3 - Local File Inclusion

The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include, which could lead to Local File Inclusion issues. id: CVE-2024-3673 info: name: Web Directory Free 1.7.3 - Local File Inclusion author: s4e-io severity: critical description: | The Web...

Web Directory Free < 1.7.0 - SQL Injection

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...

CVE-2024-3673

CVE-2024-3673 Exploit CVE-2024-3673: Inclusión Local de Archivos en el plugin gratuito Web Directory de WordPress antes de la versión 1.7.3 Descripción general CVE-2024-3673 describe una vulnerabilidad crítica en el plugin gratuito Web Directory de WordPress versiones anteriores a la 1.7.3. El...

CVE-2026-28142

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-28142

The CVE describes an Unauthenticated SQL Injection in the WordPress plugin Web Directory Free for versions up to 1.7.13 . Root cause details are not explicitly provided in the documents beyond the vulnerability type, but the CVSS v3.1 base score is 9.3 (CRITICAL) with high impact on confidentiali...

EUVD-2026-57945

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-28142

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-28142 WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-28142 WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-28142: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

PT-2026-71511

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Taylsec in WordPress Plugin Web Directory Free versions = 1.7.13...

WordPress Web Directory Free plugin <= 1.7.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nhien Pham nhienit, thevietronin in WordPress Plugin Web Directory Free versions = 1.7.13...

CVE-2026-14785

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

EUVD-2026-49737

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-14785 Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-14785

CVE-2026-14785 affects the WordPress plugin Web Directory Free (all versions up to and including 1.7.13). The root cause is insufficient escaping of the user-supplied parameter in the SQL query, and lack of proper query preparation, enabling a generic SQL injection via the levels parameter. This ...

CVE-2026-14785 Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2026-14785

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...