89 matches found
Web Directory Free < 1.7.3 - Local File Inclusion
The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include, which could lead to Local File Inclusion issues. id: CVE-2024-3673 info: name: Web Directory Free 1.7.3 - Local File Inclusion author: s4e-io severity: critical description: | The Web...
Web Directory Free < 1.7.0 - SQL Injection
The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based. id: CVE-2024-3552 info: name: Web Directory Free 1.7.0 - SQL...
CVE-2024-3673
CVE-2024-3673 CVE-2024-3673 エクスプロイト: Web Directory Free WordPress プラグインにおけるローカルファイルインクルード（1.7.3 より前） 概要 CVE-2024-3673 は、Web Directory Free WordPress プラグイン（1.7.3 より前のバージョン）における重大な脆弱性を説明しています。このプラグインは、include...
cve-2024-3552
説明 Web Directory Free（WordPress）プラグインはバージョン 1.7.0 より前で SQL インジェクションの脆弱性が存在します。AJAX 実行関数が十分にフィルタリング/サニタイズされておらず、攻撃者が SQL クエリを無効化したり、追加の句（UNION、time-based、error-based）を注入したりすることを可能にします。 コンテキスト WordPress バージョン 5.8 プラグイン web-directory-free バージョン 1.6.9 MySQL バージョン 5.7 ソースコード ajax-controller.php ファイル内 ...
CVE-2026-28142
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
EUVD-2026-57945
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
CVE-2026-28142
The CVE describes an Unauthenticated SQL Injection in the WordPress plugin Web Directory Free for versions up to 1.7.13 . Root cause details are not explicitly provided in the documents beyond the vulnerability type, but the CVSS v3.1 base score is 9.3 (CRITICAL) with high impact on confidentiali...
CVE-2026-28142
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
CVE-2026-28142 WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
CVE-2026-28142 WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
PT-2026-71511
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Taylsec in WordPress Plugin Web Directory Free versions = 1.7.13...
WordPress Web Directory Free plugin <= 1.7.13 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Nhien Pham nhienit, thevietronin in WordPress Plugin Web Directory Free versions = 1.7.13...
CVE-2026-14785
The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-14785 Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection
The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
EUVD-2026-49737
The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-14785
CVE-2026-14785 affects the WordPress plugin Web Directory Free (all versions up to and including 1.7.13). The root cause is insufficient escaping of the user-supplied parameter in the SQL query, and lack of proper query preparation, enabling a generic SQL injection via the levels parameter. This ...
CVE-2026-14785 Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection
The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
CVE-2026-14785
The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...
