WordPress security by component
Directorist
Plugin description
Directorist is a WordPress component with 21 published CVE records in this archive. The latest tracked vulnerability was published Jul 13, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
directoristLatest vulnerability
CVE-2026-59518: Directorist: Code execution
Directorist is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 8.8.2.
| Safe version |
|
||
|---|---|---|---|
| Jul 13, 2026 |
CVE-2026-59518
Directorist: Code execution
Directorist is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 8.8.2.
|
8.8.3 |
CVE9.8
NVDPending
|
| Apr 08, 2026 |
CVE-2026-39509
Directorist: A security weakness
Directorist is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 8.5.10.
|
8.6.1 |
CVE5.3
NVDPending
|
| Feb 20, 2026 |
CVE-2025-68069
Directorist: A security weakness
Directorist is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.1
NVDPending
|
| Dec 16, 2025 |
CVE-2025-64250
Directorist: An open redirect
Directorist is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.
|
See mitigation notes |
CVE4.7
NVDPending
|
| Oct 25, 2025 |
CVE-2025-10488
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Code execution
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.1
NVDPending
|
| Mar 25, 2025 |
CVE-2025-2224
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: A security weakness
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Feb 28, 2025 |
CVE-2025-1570
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Privilege escalation or authentication bypass
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE8.1
NVD9.8
|
| Feb 01, 2025 |
CVE-2024-12041
Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings: A security weakness
Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVD5.3
|
| Dec 13, 2024 |
CVE-2023-35052
Directorist: A security weakness
Directorist is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| May 03, 2024 |
CVE-2024-33929
Directorist: A security weakness
Directorist is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Feb 29, 2024 |
CVE-2024-1322
Directorist – WordPress Business Directory Plugin with Classified Ads Listings: A security weakness
Directorist – WordPress Business Directory Plugin with Classified Ads Listings is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Jan 16, 2024 |
CVE-2023-2252
Directorist: Filesystem traversal
Directorist is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE2.7
NVD2.7
|
| Nov 07, 2023 |
CVE-2023-41798
Directorist – WordPress Business Directory Plugin with Classified Ads Listings: A security weakness
Directorist – WordPress Business Directory Plugin with Classified Ads Listings is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.1
NVD8.8
|
| Jun 09, 2023 |
CVE-2023-1889
Directorist: A security weakness
Directorist is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD6.5
|
| Jun 09, 2023 |
CVE-2023-1888
Directorist: A security weakness
Directorist is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Dec 19, 2022 |
CVE-2022-3961
Directorist: A security weakness
Directorist is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD6.5
|
| Dec 12, 2022 |
CVE-2022-3930
Directorist: A security weakness
Directorist is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD6.5
|
| Sep 05, 2022 |
CVE-2022-2376
Directorist: A security weakness
Directorist is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVD5.3
|
| Aug 22, 2022 |
CVE-2022-2377
Directorist: Cross-site request forgery
Directorist is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD4.3
|
| Aug 08, 2022 |
CVE-2022-2046
Directorist: A security weakness
Directorist is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.9
NVD4.9
|
| Dec 21, 2021 |
CVE-2021-24981
Directorist: Cross-site request forgery
Directorist is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE7.5
NVD7.5
|