DI
Product
Directorist
18
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 4Medium 11Low 1
Watch
Add Directorist to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59518 | 9.8 | Jul 13 | WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability Affected: through 8.8.2 |
| CVE-2025-1570 | 9.8 | Feb 28 | Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP Affected: before 8.2 |
| CVE-2023-41798 | 8.8 | Nov 7 | WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection Affected: through 7.7.1 |
| CVE-2023-1888 | 8.8 | Jun 9 | Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation Affected: through 7.5.4 |
| CVE-2021-24981 | 7.5 | Dec 21 | The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins… Affected: before 7.0.6.2 |
| CVE-2025-68069 | 7.1 | Feb 20 | WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability Affected: through 8.6.6 |
| CVE-2023-1889 | 6.5 | Jun 9 | Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task Affected: through 7.5.4 |
| CVE-2022-3961 | 6.5 | Dec 19 | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information Affected: before 7.4.4 |
| CVE-2022-3930 | 6.5 | Dec 12 | The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own Affected: before 7.4.2.2 |
| CVE-2026-39509 | 5.3 | Apr 8 | WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability Affected: through 8.5.10 |
| CVE-2024-12041 | 5.3 | Feb 1 | Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure Affected: before 8.1 |
| CVE-2024-33929 | 5.3 | May 3 | WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerability Affected: through 7.8.6 |
| CVE-2024-1322 | 5.3 | Feb 20 | Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change Affected: before 7.8.5 |
| CVE-2022-2376 | 5.3 | Sep 5 | The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users Affected: before 7.3.1 |
| CVE-2022-2046 | 4.9 | Aug 8 | Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload Affected: before 7.2.3 |
| CVE-2025-64250 | 4.7 | Dec 16 | WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability Affected: through 8.6.6 |
| CVE-2022-2377 | 4.3 | Aug 22 | The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of… Affected: before 7.3.0 |
| CVE-2023-2252 | 2.7 | Jan 16 | Directorist < 7.5.4 - Admin+ LFI Affected: before 7.5.4 |
Showing 18