Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: Directorist: AI-Powered Business Directory, Listings & Classified Ads 8.11 Clear all filters
TI-2026-86421 CVE-2026-118534 · GHSA-66q8-qh5w-5952

Insecure direct object reference in Directorist payment retry

Priority LOW 19

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, all…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00185 Published 2026-11-07 Fixed in 8.11 CWE-639
TI-2026-86420 CVE-2026-118533 · GHSA-c6hc-949q-jjm9

Authorization bypass in Directorist exposes other users' payment receipts

Priority LOW 19

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user,…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00197 Published 2026-11-07 Fixed in 8.11 CWE-639
TI-2026-86419 CVE-2026-118532 · GHSA-2qqm-h6h2-8xxq

Directorist plugin lets subscribers delete arbitrary media attachments

Priority LOW 28

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users w…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00238 Published 2026-11-07 Fixed in 8.11 CWE-73
TI-2026-86418 CVE-2026-118530 · GHSA-7fjq-qqj3-wh4h

Directorist cross-site account lockout via email verification

Priority LOW 22

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on mu…

CVSS 3.1MEDIUM 5.0 Network High privileges No interaction EPSS 0.00211 Published 2026-11-07 Fixed in 8.11 CWE-863
TI-2026-86417 CVE-2026-118529 · GHSA-vhhg-rqv5-623c

Directorist lets subscribers publish others' pending listings

Priority LOW 14

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authent…

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00162 Published 2026-11-07 Fixed in 8.11 CWE-863
TI-2026-86416 CVE-2026-118528 · GHSA-rqcg-qxvw-p753

Directorist Subscriber+ Draft Listing Contact Information Disclosure via IDOR

Priority LOW 19

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX acti…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00197 Published 2026-11-07 Fixed in 8.11 CWE-639