Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-23
Directorist - Security Vulnerability (CVE-2026-84098)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
PLUGIN
Directorist
CVE-2026-84098
Risk Score
Threat Entry
Updated 2026-09-23
Directorist - Security Vulnerability (CVE-2026-84150)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
PLUGIN
Directorist
CVE-2026-84150
Risk Score
Threat Entry
Updated 2026-09-23
Directorist - Security Vulnerability (CVE-2026-84026)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.
PLUGIN
Directorist
CVE-2026-84026
Risk Score
Threat Entry
Updated 2026-09-23
Directorist - Security Vulnerability (CVE-2026-84046)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.
PLUGIN
Directorist
CVE-2026-84046
Risk Score
Threat Entry
Updated 2026-09-23
Directorist - Security Vulnerability (CVE-2026-84027)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.
PLUGIN
Directorist
CVE-2026-84027
Risk Score
Threat Entry
Updated 2026-09-23
Directorist - Security Vulnerability (CVE-2026-77766)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to 8.9 are not affected. The endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1.
PLUGIN
Directorist
CVE-2026-77766
Risk Score
Threat Entry
Updated 2026-09-08
Directorist - Broken Access Control (CVE-2026-84066)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
PLUGIN
Directorist
CVE-2026-84066
Risk Score
Threat Entry
Updated 2026-08-26
Directorist - Cross-Site Scripting (XSS) (CVE-2026-77757)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
PLUGIN
Directorist
CVE-2026-77757
Risk Score
Threat Entry
Updated 2026-07-13
Directorist - PHP Object Injection (CVE-2026-59518)
Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through
PLUGIN
Directorist
CVE-2026-59518
Risk Score
Threat Entry
Updated 2026-07-24
Directorist - Broken Access Control (CVE-2026-39509)
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through
PLUGIN
Directorist
CVE-2026-39509
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Broken Access Control (CVE-2025-68069)
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through
PLUGIN
Directorist
CVE-2025-68069
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Open Redirect (CVE-2025-64250)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wpWax Directorist directorist allows Phishing.This issue affects Directorist: from n/a through
PLUGIN
Directorist
CVE-2025-64250
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Broken Access Control (CVE-2025-12174)
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions in all versions up to, and including, 8.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export listing details and change the directorist slug.
PLUGIN
Directorist
CVE-2025-12174
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Remote Code Execution (CVE-2025-10488)
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
PLUGIN
Directorist
CVE-2025-10488
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Broken Access Control (CVE-2025-2224)
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.
PLUGIN
Directorist
CVE-2025-2224
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Privilege Escalation (CVE-2025-1570)
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_generate_password_reset_pin_code() and reset_user_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users…
PLUGIN
Directorist
CVE-2025-1570
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Information Disclosure (CVE-2024-12041)
The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12 via the /wp-json/directorist/v1/users/ endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including including usernames, email addresses, names, and more information about users.
PLUGIN
Directorist
CVE-2024-12041
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Broken Access Control (CVE-2024-1322)
The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and enable or disable monetization and change map provider.
PLUGIN
Directorist
CVE-2024-1322
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Path Traversal (CVE-2023-2252)
The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files.
PLUGIN
Directorist
CVE-2023-2252
Risk Score
Threat Entry
Updated 2026-06-17
Directorist - Security Vulnerability (CVE-2023-41798)
Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.
PLUGIN
Directorist
CVE-2023-41798
Risk Score