Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: Directorist: AI-Powered Business Directory, Listings & Classified Ads 8.9.5 Clear all filters
TI-2026-57871 CVE-2026-84150 · GHSA-qm62-48pg-2f99

Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint

Priority LOW 24

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying t…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0023 Published 2026-09-23 Fixed in 8.9.5 CWE-639
TI-2026-57827 CVE-2026-84098 · GHSA-7mc4-vjfr-47h6

Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing

Priority LOW 29

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00299 Published 2026-09-23 Fixed in 8.9.5 CWE-863
TI-2026-57796 CVE-2026-84046 · GHSA-6q63-3w56-m722

Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL

Priority LOW 22

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and ab…

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.0027 Published 2026-09-23 Fixed in 8.9.5 CWE-918
TI-2026-57787 CVE-2026-84027 · GHSA-cq43-6mf7-3fqw

Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint

Priority LOW 20

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-09-23 Fixed in 8.9.5 CWE-862
TI-2026-57786 CVE-2026-84026 · GHSA-6qmw-q735-cv6h

Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint

Priority LOW 30

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read re…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00345 Published 2026-09-23 Fixed in 8.9.5 CWE-200
TI-2026-54159 CVE-2026-77766 · GHSA-rc7w-56jp-5gfx

Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint

Priority LOW 20

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level a…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-09-23 Fixed in 8.9.5 CWE-639