Filtered by vendor Wordpress-extensions Subscriptions
Filtered by product Wp Directory Kit Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-96653 2 Wordpress-extensions, Wpdirectorykit 2 Wp Directory Kit, Wp Directory Kit 2026-10-19 6.5 Medium
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a display_name containing a single quote via their own profile, which WordPress preserves verbatim; the payload is then triggered when WdkCachedUserEditor::update_listings_user_editor() re-reads that stored value and passes it unsanitized to the SQL sink.
CVE-2026-16591 1 Wordpress-extensions 1 Wp Directory Kit 2026-09-27 7.2 High
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.