228 matches found
WordPress WP Directory Kit plugin < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user vulnerability
Unauthenticated User Email Disclosure via select2ajaxuser vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.7...
WordPress WP Directory Kit plugin < 1.5.7 - Admin+ SQL Injection via section Parameter vulnerability
Admin+ SQL Injection via section Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.7...
CVE-2026-18231
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...
CVE-2026-18231
The WP Directory Kit WordPress plugin (versions before 1.5.7 ) contains a vulnerability where a public AJAX action, specifically select_2_ajax_user, fails to perform adequate authorization checks . This flaw allows unauthenticated attackers to retrieve unfiltered database rows, resulting in the e...
CVE-2026-18231 WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...
CVE-2026-18231 WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...
EUVD-2026-62279
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...
CVE-2026-18231: Exposure of Sensitive Information to an Unauthorized Actor
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...
PT-2026-78293
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...
WordPress WP Directory Kit plugin < 1.5.6 - Subscriber+ SQL Injection via section Parameter vulnerability
Subscriber+ SQL Injection via section Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.6...
WordPress WP Directory Kit plugin < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category vulnerability
Unauthenticated SQL Injection via searchlocation and searchcategory vulnerability discovered by Pedro Pinho in WordPress Plugin WP Directory Kit versions 1.5.6...
CVE-2026-18653
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653
The WP Directory Kit WordPress plugin (versions before 1.5.7 ) is vulnerable to SQL injection because it fails to sanitize and escape a parameter used in a SQL statement. This vulnerability allows administrators to perform SQL injection attacks. In a multisite installation , an administrator of a...
EUVD-2026-59912
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653 WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653 WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
CVE-2026-18653: Improper Neutralization of Special Elements used in an SQL Command
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...
PT-2026-73120
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...