IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
5.3Media

CVE-2024-12041Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure

wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads Publicada: (hace 1 año)

Descripción

The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12 via the /wp-json/directorist/v1/users/ endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including including usernames, email addresses, names, and more information about users.

Debilidad (CWE): CWE-359

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
wpwax directorist < 8.1
wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads ≤ 8.0.12

Referencias y parches

Coincidencias CPE (NVD) (1)
  • cpe:2.3:a:wpwax:directorist:*:*:*:*:*:wordpress:*:* < 8.1

CVE recientes del mismo producto — WordPress plugins & themes

7.2Alta
CVE-2026-120687

Lightbox & Modal Popup WordPress Plugin <= 2.8.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers

fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient…

9.8Crítica
CVE-2026-19907

Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator

shipo Shipo

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's c…