6 results · Clear filters · Feed
-
High 7.5
WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis…
-
High 7.5
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
-
High 7.5
WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa…
-
High 7.5
WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of suf…
-
High 8.8CVE-2024-3217 Public exploit
WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient pre…
-
High 7.1
WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.2.9.