Security Advisory

CVE-2026-18474

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-12 06:00:17

Last updated 2026-08-12 12:34:27

Assigner WPScan

CVSS score 8.6

State PUBLISHED

Description

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

← Browse all CVEs View on cve.org ↗