Skip to content
OpenAdvisories

Vendor

wpdirectorykit

23 known vulnerabilities.

Products

WP Directory Kit 21 Sweet Energy Efficiency 2
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-109197

    WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

    The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis…

    wpdirectorykit WP Directory Kit Web / CMS
  • High 7.5
    CVE-2026-27538

    WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

    wpdirectorykit WP Directory Kit
  • High 7.5
    CVE-2025-13089

    WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection

    The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa…

    wpdirectorykit WP Directory Kit Web / CMS
  • High 7.5
    CVE-2025-13138

    WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function

    The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of suf…

    wpdirectorykit WP Directory Kit Web / CMS
  • High 7.1
    CVE-2025-58262

    WordPress Sweet Energy Efficiency plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPDirectoryKit Sweet Energy Efficiency sweet-energy-efficiency allows Stored XSS.This issue affects Sweet Energy Efficiency: from n/a through <= 1.0.8.

    wpdirectorykit Sweet Energy Efficiency
  • High 8.8
    CVE-2024-3217 Public exploit

    WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection

    The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient pre…

    wpdirectorykit WP Directory Kit Web / CMS
  • High 7.1
    CVE-2024-29774

    WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.2.9.

    wpdirectorykit WP Directory Kit