Wpdirectorykit Wp Directory Kit vulnerabilities, page 2

24 vulnerabilities

Known vulnerabilities in Wpdirectorykit Wp Directory Kit, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2023-2277wordpresswpdirectorykit+1
EPSS score
0.34%
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.6.5CVE-2023-2280wordpresswpdirectorykit+1
EPSS score
0.60%
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0 and an additional partial patch was introduced in version 1.2.2, but the issue was not fully patched until 1.2.3.9.8CVE-2023-41875wordpresswpdirectorykit+2
EPSS score
0.79%
Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6.6.1CVE-2023-31229wordpresswpdirectorykit+2
EPSS score
0.32%
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP Directory Kit.This issue affects WP Directory Kit: from n/a through 1.1.9.