Skip to content
OpenAdvisories

Vendor

e-plugins

33 known vulnerabilities.

e-plugins at a glance

Last 12 months
28
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 13 25 December 2025: 2 vulnerabilities Dec 2025 January 2026: 23 vulnerabilities February 2026: 0 vulnerabilities March 2026: 2 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability, 1 critical September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202611
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202620
Feb 202600
Jan 2026230
Dec 202520
Nov 202510
Oct 202510
Sep 202510
Aug 202510
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Directory Pro 5 Lawyer Directory 4 Hotel Listing 4 WP Membership 4 Institutions Directory 4 Hospital Doctor Directory 3 Final User 2 Real Estate Pro 2 ListingHub 2 Listihub 1 JobBank 1 fitness-trainer 1
All Critical High Medium Low Exploited only Public exploit

33 results · Feed

  • Critical 9.3
    CVE-2026-66649

    WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.

    e-plugins Directory Pro
  • High 7.1
    CVE-2026-28127

    WordPress Lawyer Directory plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Lawyer Directory lawyer-directory allows Reflected XSS.This issue affects Lawyer Directory: from n/a through <= 1.3.2.

    e-plugins Lawyer Directory
  • High 7.3
    CVE-2026-27396

    WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.

    e-plugins Directory Pro
  • High 8.8
    CVE-2025-69293

    WordPress Final User plugin <= 1.2.5 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <= 1.2.5.

    e-plugins Final User
  • High 7.3
    CVE-2025-69191

    WordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingHub: from n/a through <= 1.2.7.

    e-plugins ListingHub
  • High 7.3
    CVE-2025-69192

    WordPress Real Estate Pro plugin <= 2.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Pro: from n/a through <= 2.1.5.

    e-plugins Real Estate Pro
  • High 7.3
    CVE-2025-69190

    WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a through <= 1.0.6.

    e-plugins Listihub
  • High 7.3
    CVE-2025-69193

    WordPress WP Membership plugin <= 1.6.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.4.

    e-plugins WP Membership
  • High 8.8
    CVE-2025-69292

    WordPress WP Membership plugin <= 1.6.4 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Membership: from n/a through <= 1.6.4.

    e-plugins WP Membership
  • High 7.3
    CVE-2025-69184

    WordPress Institutions Directory plugin <= 1.3.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3.4.

    e-plugins Institutions Directory
  • High 7.3
    CVE-2025-69185

    WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.

    e-plugins Hotel Listing
  • High 7.3
    CVE-2025-69187

    WordPress Final User plugin <= 1.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n/a through <= 1.2.5.

    e-plugins Final User
  • High 7.3
    CVE-2025-69186

    WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.

    e-plugins Hospital Doctor Directory
  • High 7.3
    CVE-2025-69188

    WordPress fitness-trainer plugin <= 1.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fitness-trainer: from n/a through <= 1.7.1.

    e-plugins fitness-trainer
  • High 8.8
    CVE-2025-69182

    WordPress Institutions Directory plugin <= 1.3.4 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in e-plugins Institutions Directory institutions-directory allows Privilege Escalation.This issue affects Institutions Directory: from n/a through <= 1.3.4.

    e-plugins Institutions Directory
  • High 8.8
    CVE-2025-69183

    WordPress Hospital Doctor Directory plugin <= 1.3.9 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.

    e-plugins Hospital Doctor Directory
  • High 7.3
    CVE-2025-69181

    WordPress Lawyer Directory plugin <= 1.3.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.4.

    e-plugins Lawyer Directory
  • High 7.1
    CVE-2025-69056

    WordPress Hotel Listing plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Hotel Listing hotel-listing allows Reflected XSS.This issue affects Hotel Listing: from n/a through <= 1.4.0.

    e-plugins Hotel Listing
  • High 7.6
    CVE-2025-68059

    WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.

    e-plugins Hotel Listing
  • High 7.6
    CVE-2025-68057

    WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.

    e-plugins Hospital Doctor Directory
  • High 7.6
    CVE-2025-68058

    WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3..4.

    e-plugins Institutions Directory
  • High 8.8
    CVE-2025-67966

    WordPress Lawyer Directory plugin <= 1.3.3 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3.3.

    e-plugins Lawyer Directory
  • High 7.6
    CVE-2025-67967

    WordPress Lawyer Directory plugin <= 1.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3.

    e-plugins Lawyer Directory
  • High 7.1
    CVE-2025-13504

    WordPress Real Estate Pro plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affects Real Estate Pro: from n/a through <= 2.1.4.

    e-plugins Real Estate Pro
  • High 7.1
    CVE-2025-12551

    WordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This issue affects ListingHub: from n/a through 1.2.6.

    e-plugins ListingHub
  • High 7.1
    CVE-2025-69085

    WordPress JobBank plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins JobBank jobbank allows Reflected XSS.This issue affects JobBank: from n/a through <= 1.2.2.

    e-plugins JobBank
  • High 8.8
    CVE-2025-58710

    WordPress Hotel Listing plugin <= 1.4.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in e-plugins Hotel Listing hotel-listing allows Privilege Escalation.This issue affects Hotel Listing: from n/a through <= 1.4.0.

    e-plugins Hotel Listing
  • Medium 4.3
    CVE-2025-64243

    WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.

    e-plugins Directory Pro
  • High 7.1
    CVE-2025-58638

    WordPress Institutions Directory Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Institutions Directory institutions-directory allows Reflected XSS.This issue affects Institutions Directory: from n/a through <= 1.3.3.

    e-plugins Institutions Directory
  • High 7.1
    CVE-2025-52748

    WordPress Directory Pro plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows Reflected XSS.This issue affects Directory Pro: from n/a through <= 2.5.5.

    e-plugins Directory Pro
  • Medium 6.5
    CVE-2025-57948

    WordPress Directory Pro Plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows DOM-Based XSS.This issue affects Directory Pro: from n/a through <= 2.5.5.

    e-plugins Directory Pro
  • Medium 5.4
    CVE-2025-54717

    WordPress WP Membership Plugin <= 1.6.3 - Settings Change Vulnerability

    Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.3.

    e-plugins WP Membership
  • Critical 9.8
    CVE-2024-10547

    WP Membership <= 1.6.2 - Unauthenticated Arbitrary File Upload

    The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the user_profile_image_upload() function in all versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to…

    e-plugins WP Membership Web / CMS