WP Directory Kit <= 1.4.4 - Authentication Bypass

The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism tha...

CVE-2025-13390

CVE-2025-13390 WP Directory Kit The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in thewdkgenerateautologinlink function. This is due to the feature using a...

CVE-2025-13390

WP Directory Kit = 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover Summary The WP Directory Kit plugin for Wordpress version 1.4.4 and below contains an authentication bypass in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain...

CVE-2024-3217-POC

CVE-2024-3217-POC Mitre Description The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attributevalue' and 'attributeid' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-114703

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-109197

The WP Directory Kit plugin for WordPress (versions up to and including 1.6.0 ) is vulnerable to an unauthenticated SQL Injection . The root cause is insufficient escaping of the user-supplied 'idfield' parameter and a lack of sufficient preparation on existing SQL queries. This flaw allows unaut...

CVE-2026-109197 WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

WordPress WP Directory Kit plugin <= 1.6.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Spy0x7 in WordPress Plugin WP Directory Kit versions = 1.6.0...

CVE-2026-109197: wpdirectorykit WP Directory Kit: The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all…

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

PT-2026-134500

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.6.1 Description An issue exists where unauthenticated attackers can perform SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs due to...

CVE-2026-96653

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

EUVD-2026-96283

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-96653

The WP Directory Kit plugin for WordPress (versions

CVE-2026-96653 WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-96653 WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-96653: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-109606

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display name' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

WordPress WP Directory Kit plugin <= 1.5.9 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP Directory Kit versions = 1.5.9...

CVE-2026-16596

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'datafieldslist' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-16596

The WP Directory Kit plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 1.5.4 . The root cause is insufficient escaping of the user-supplied data_fields_list parameter combined with a lack of sufficient preparation on the existing SQL query. This vul...