CVE-2024-29774

CVE-2024-29774 is a Reflected XSS in WP Directory Kit (WPDirectoryKit) due to Improper Neutralization of Input During Web Page Generation. Affected: WPDirectoryKit versions from n/a through 1.2.9. Root cause, impact, and remediation details are present in connected sources (Red Hat and ENISA entr...

CVE-2024-29774 WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.2.9...

CVE-2024-29774: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.2.9...

CVE-2023-31229

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in WP Directory Kit.This issue affects WP Directory Kit: from n/a through 1.1.9...

Open redirect

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in WP Directory Kit.This issue affects WP Directory Kit: from n/a through 1.1.9...

CVE-2023-31229

CVE-2023-31229: Open Redirection in WordPress WP Directory Kit (

PT-2023-23250 · WordPress · Wp Directory Kit

Name of the Vulnerable Software and Affected Versions: WP Directory Kit versions 1.1.9 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, in WP Directory Kit. This vulnerability allows for redirection to untrusted...

CVE-2023-31229: URL Redirection to Untrusted Site

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in WP Directory Kit.This issue affects WP Directory Kit: from n/a through 1.1.9...

WordPress Plugin WP Directory Kit Input Validation Error Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2023-2279

CVE-2023-2279 pertains to the WP Directory Kit WordPress plugin. Concrete details show a CSRF vulnerability in versions up to 1.2.1 due to missing/incorrect nonce validation in the admin_page_display function, enabling unauthenticated attackers to delete or modify plugin settings, import demo dat...

CVE-2023-2279: Cross-Site Request Forgery (CSRF)

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...

CVE-2023-2277 WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and...

CVE-2023-2277

The CVE-2023-2277 issue affects the WP Directory Kit WordPress plugin (versions up to 1.1.9). It is a Cross-Site Request Forgery (CSRF) vulnerability caused by missing/incorrect nonce validation on the insert function. This allows unauthenticated attackers to alter plugin settings and inject mali...

CVE-2023-2277 WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and...

CVE-2023-2351 WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action

The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxadmin' function in versions up to, and including, 1.2.3. This makes it possible for authenticated attackers with subscriber-level permissions...

CVE-2023-2278: Improper Limitation of a Pathname to a Restricted Directory

The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdkpublicaction' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those...

PT-2023-18685

Name of the Vulnerable Software and Affected Versions WP Directory Kit plugin for WordPress versions up to, and including, 1.1.9 Description The issue is due to missing or incorrect nonce validation on the insert function, making it possible for unauthenticated attackers to update the plugin's...

PT-2023-19001

Name of the Vulnerable Software and Affected Versions WP Directory Kit plugin for WordPress versions up to, and including, 1.2.3 Description The issue allows unauthorized modification and loss of data due to a missing capability check on the ajax admin function. This enables authenticated attacke...

CVE-2023-2351: Missing Authorization

The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxadmin' function in versions up to, and including, 1.2.3. This makes it possible for authenticated attackers with subscriber-level permissions...

CVE-2023-2277: Cross-Site Request Forgery (CSRF)

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and...