WordPress security by component

DirectoryPress

Plugin description

DirectoryPress is a WordPress component with 11 published CVE records in this archive. The latest tracked vulnerability was published Apr 08, 2026; the highest CVE/CNA score is 8.5.

Plugin slug: directorypress

Latest vulnerability

CVE-2026-39566: DirectoryPress: A security weakness

DirectoryPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.6.26.

PublishedApr 08, 2026

Known safe version3.6.27

		Safe version
Apr 08, 2026	CVE-2026-39566 DirectoryPress: A security weakness DirectoryPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.6.26.	3.6.27	CVE4.3 NVDPending
Feb 19, 2026	CVE-2026-27387 DirectoryPress: A security weakness DirectoryPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4 NVDPending
Feb 19, 2026	CVE-2026-23548 DirectoryPress: A security weakness DirectoryPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Oct 27, 2025	CVE-2025-62967 DirectoryPress: Cross-site scripting DirectoryPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVDPending
Apr 04, 2025	CVE-2025-32249 DirectoryPress: Cross-site request forgery DirectoryPress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.4 NVDPending
Feb 15, 2025	CVE-2024-10581 DirectoryPress Frontend: Cross-site request forgery DirectoryPress Frontend is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVDPending
Jan 07, 2025	CVE-2024-49633 DirectoryPress: Cross-site scripting DirectoryPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVD6.1
Dec 24, 2024	CVE-2024-10584 DirectoryPress – Business Directory And Classified Ad Listing: Cross-site scripting DirectoryPress – Business Directory And Classified Ad Listing is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVDPending
Dec 13, 2024	CVE-2023-37967 DirectoryPress: A security weakness DirectoryPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVD9.8
Jul 22, 2024	CVE-2024-38755 DirectoryPress: SQL injection DirectoryPress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.5 NVD8.8
Apr 18, 2024	CVE-2024-32567 DirectoryPress: Cross-site scripting DirectoryPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE7.1 NVD6.1