CVE-2024-3552

CVE-2024-3552 affects the Web Directory Free WordPress plugin prior to 1.7.0. An unauthenticated AJAX action uses an unsanitised parameter in a SQL statement, enabling SQL injection via UNION, time-based, and error-based techniques, potentially compromising the database. The nuclei template confi...

CVE-2024-3673

The Web Directory Free WordPress plugin (versions prior to 1.7.3 ) is vulnerable to Local File Inclusion (LFI) . The root cause is a failure to validate a parameter before its use in an include() function, specifically via the w2dc_controller_request action on the admin-ajax.php endpoint. This fl...

CVE-2024-3669

The Web Directory Free WordPress plugin versions prior to 1.7.2 is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. This issue arises because the plugin fails to properly sanitise and escape a parameter before outputting it back to the page. An attacker could exploit this to target high...

CVE-2023-2201

CVE-2023-2201 affects Web Directory Free for WordPress (plugin) up to version 1.6.7. Root cause: insufficient escaping and lack of prepared SQL in the post_id parameter, enabling an authenticated contributor to inject additional SQL into existing queries and potentially exfiltrate data. Public de...