CVE-2026-32474WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability Exploitation status Not known exploited Fix Affected product T Templatiq Published 08/18/2026 Severity Critical CVE-2025-15028FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More Published 08/06/2026 Severity High CVE-2026-3141FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter Exploitation status Not known exploited Fix Affected product F FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More Published 08/01/2026 Severity Critical CVE-2026-59518WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product D Directorist Published 07/13/2026 Severity Critical CVE-2026-49073WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product D Directorist Booking Published 06/16/2026 Severity High CVE-2026-39509WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product D Directorist Published 04/08/2026 Severity Medium CVE-2026-22460WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerability Exploitation status Not known exploited Fix Affected product F FormGent Published 03/05/2026 Severity High CVE-2025-68069WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product D Directorist Published 02/20/2026 Severity High CVE-2025-64250WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability Exploitation status Not known exploited Fix Affected product D Directorist Published 12/16/2025 Severity Medium CVE-2025-66077WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product L Legal Pages Published 11/21/2025 Severity Medium CVE-2025-12174Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update Exploitation status Not known exploited Fix Affected product D Directorist: AI-Powered Business Directory, Listings & Classified Ads Published 11/19/2025 Severity Medium CVE-2025-10488Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move Exploitation status Not known exploited Fix Affected product D Directorist: AI-Powered Business Directory, Listings & Classified Ads Published 10/25/2025 Severity High CVE-2025-48242WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control Vulnerability Exploitation status Not known exploited Fix Affected product L Legal Pages Published 05/19/2025 Severity Medium CVE-2025-32658WordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product H HelpGent Published 04/17/2025 Severity Critical CVE-2025-39525WordPress Logo Carousel Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product L Logo Carousel Slider Published 04/16/2025 Severity Medium CVE-2025-32499WordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product L Logo Showcase Ultimate Published 04/09/2025 Severity Medium CVE-2025-31857WordPress Directorist AddonsKit for Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product D Directorist AddonsKit for Elementor Published 04/01/2025 Severity Medium CVE-2025-2224Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing Exploitation status Not known exploited Fix Affected product D Directorist: AI-Powered Business Directory, Listings & Classified Ads Published 03/25/2025 Severity Medium CVE-2025-1570Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP Exploitation status Not known exploited Fix Affected product D Directorist: AI-Powered Business Directory, Listings & Classified Ads Published 02/28/2025 Severity High CVE-2024-12041Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure Exploitation status Not known exploited Fix Affected product D Directorist: AI-Powered Business Directory, Listings & Classified Ads Published 02/01/2025 Severity Medium CVE-2025-24782WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product P Post Grid, Slider & Carousel Ultimate Published 01/27/2025 Severity Medium CVE-2025-24681WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.10.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product P Product Carousel Slider & Grid Ultimate for WooCommerce Published 01/24/2025 Severity Medium CVE-2024-13408Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion Exploitation status Not known exploited Fix Affected product P Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Published 01/24/2025 Severity High CVE-2024-13409Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler() Exploitation status Not known exploited Fix Affected product P Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Published 01/24/2025 Severity High CVE-2023-35052WordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerability Exploitation status Not known exploited Fix Affected product D Directorist Published 12/13/2024 Severity Medium CVE-2024-12040Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme' Exploitation status Not known exploited Fix Affected product P Product Carousel Slider & Grid Ultimate for WooCommerce Published 12/12/2024 Severity High CVE-2024-44048WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product P Product Carousel Slider & Grid Ultimate for WooCommerce Published 09/23/2024 Severity Medium CVE-2024-8046Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product L Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Published 08/27/2024 Severity Medium CVE-2024-33929WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product D Directorist Published 05/03/2024 Severity Medium CVE-2024-32451WordPress Legal Pages plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product L Legal Pages Published 04/15/2024 Severity Medium CVE-2024-29925WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product P Post Grid, Slider & Carousel Ultimate Published 03/27/2024 Severity Medium CVE-2023-50886WordPress Legal Pages plugin <= 1.3.7 - CSRF + Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product L Legal Pages Published 03/15/2024 Severity Medium CVE-2024-1950Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.7 - Authenticated(Contributor+) PHP Object Injection Exploitation status Not known exploited Fix Affected product P Product Carousel Slider & Grid Ultimate for WooCommerce Published 03/13/2024 Severity High CVE-2024-1951Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injection Exploitation status Not known exploited Fix Affected product L Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Published 03/13/2024 Severity High CVE-2024-2006Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup Exploitation status Not known exploited Fix Affected product P Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Published 03/13/2024 Severity High CVE-2024-1322Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change Exploitation status Not known exploited Fix Affected product D Directorist: AI-Powered Business Directory, Listings & Classified Ads Published 02/20/2024 Severity Medium CVE-2023-2252Directorist < 7.5.4 - Admin+ LFI Exploitation status Public exploit Fix Affected product D Directorist Published 01/16/2024 Severity Low CVE-2023-47824WordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not confirmed Fix Affected product L Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator Published 11/22/2023 Severity Medium CVE-2023-41798WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection Exploitation status Not known exploited Fix Affected product D Directorist – WordPress Business Directory Plugin with Classified Ads Listings Published 11/07/2023 Severity High CVE-2023-1889Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task Exploitation status Not known exploited Fix Affected product D Directorist: AI-Powered Business Directory, Listings & Classified Ads Published 06/09/2023 Severity Medium CVE-2023-1888Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation Exploitation status Not known exploited Fix Affected product D Directorist: AI-Powered Business Directory, Listings & Classified Ads Published 06/09/2023 Severity High CVE-2022-3961Directorist < 7.4.4 - Subscriber+ Sensitive Information Disclosure Exploitation status Public exploit Fix Affected product D Directorist Published 12/19/2022 Severity Medium CVE-2022-3930Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR Exploitation status Public exploit Fix Affected product D Directorist Published 12/12/2022 Severity Medium CVE-2022-2376Directorist < 7.3.1 - Unauthenticated Email Address Disclosure Exploitation status Not confirmed Fix Affected product D Directorist – WordPress Business Directory Plugin with Classified Ads Listings Published 09/05/2022 Severity Unknown CVE-2022-2377Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending Exploitation status Not confirmed Fix Affected product D Directorist – WordPress Business Directory Plugin with Classified Ads Listings Published 08/22/2022 Severity Unknown CVE-2022-2046Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload Exploitation status Not confirmed Fix Affected product D Directorist – WordPress Business Directory Plugin with Classified Ads Listings Published 08/08/2022 Severity Unknown CVE-2022-34650WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities Exploitation status Not known exploited Fix Not confirmed Affected product T Team (WordPress plugin) Published 07/22/2022 Severity Medium CVE-2022-34853WordPress Team plugin <= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities Exploitation status Not known exploited Fix Not confirmed Affected product T Team (WordPress plugin) Published 07/22/2022 Severity Medium CVE-2022-1266Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS Exploitation status Not confirmed Fix Affected product P Post Grid, Slider & Carousel Ultimate Published 06/20/2022 Severity Unknown CVE-2021-24981Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload Exploitation status Not confirmed Fix Affected product D Directorist – Business Directory Plugin Published 12/21/2021 Severity Unknown 
.svg){kind=icon}
