WordPress security by component
WP Directory Kit
Plugin description
WP Directory Kit is a WordPress component with 6 published CVE records in this archive. The latest tracked vulnerability was published Jan 24, 2026; the highest CVE/CNA score is 10.
Plugin slug:
wp-directory-kitLatest vulnerability
CVE-2025-13920: WP Directory Kit: Sensitive information exposure
WP Directory Kit is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
| Safe version |
|
||
|---|---|---|---|
| Jan 24, 2026 |
CVE-2025-13920
WP Directory Kit: Sensitive information exposure
WP Directory Kit is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 13, 2025 |
CVE-2025-13089
WP Directory Kit: SQL injection
WP Directory Kit is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Dec 03, 2025 |
CVE-2025-13390
WP Directory Kit: Privilege escalation or authentication bypass
WP Directory Kit is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.
|
See mitigation notes |
CVE10.0
NVD9.8
|
| Dec 02, 2025 |
CVE-2025-13090
WP Directory Kit: SQL injection
WP Directory Kit is affected by SQL injection. Exploitation requires at least administrator-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE4.9
NVDPending
|
| Dec 13, 2024 |
CVE-2023-41875
WP Directory Kit: A security weakness
WP Directory Kit is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVD9.8
|
| Jun 02, 2023 |
CVE-2023-2835
WP Directory Kit: Cross-site scripting
WP Directory Kit is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|