CVE-2026-27538

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

EUVD-2026-57941

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-28001

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-28001 WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-28001

The CVE-2026-28001 entry concerns the WP Directory Kit WordPress plugin, affected versions

CVE-2026-28001 WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

EUVD-2026-57936

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27538 WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27538 WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27538

CVE-2026-27538 affects the WordPress WP Directory Kit plugin up to version 1.5.4, with an unauthenticated SQL injection vulnerability. The underlying root cause, affected files/components, and exact exploitation flow are not detailed in the provided documents. CVSS 3.1 base score is 7.5 (HIGH) wi...

PT-2026-71506

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

PT-2026-71501

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-28001: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-27538: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jayant Kamble in WordPress Plugin WP Directory Kit versions = 1.5.4...

CVE-2026-18474

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

CVE-2026-18230

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...

CVE-2026-18474

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

CVE-2026-18230

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...

CVE-2026-18230

The WP Directory Kit WordPress plugin (versions before 1.5.6 ) is vulnerable to a SQL injection attack. The root cause is the failure to sanitise and escape a parameter before its use in a SQL statement via an authenticated AJAX action that lacks proper authorization checks . This allows any auth...