CVE-2025-69018
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A DOM-Based Cross-site Scripting vulnerability in the Web Directory Free plugin (versions up to and including 1.7.12) arises from improper neutralization of input during web page generation. An attacker can inject a malicious script that executes in the user's browser.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser context, potentially leading to session theft, credential theft, or content modification. This may compromise the security of directory users.
Recommendation
Update the Web Directory Free plugin to the latest version if available, or consider disabling it until a fix is released. Consider implementing CSP headers to restrict script execution.
Other vulnerabilities in Web Directory Free
See all- CVE-2026-28142Critical
Unauthenticated SQL Injection vulnerability in Web Directory Free versions up to 1.7.13. An attacker can execute arbitrary SQL queries without authentication.
- CVE-2026-14785High
The Web Directory Free plugin for WordPress up to version 1.7.13 is vulnerable to generic SQL Injection via the 'levels' parameter. Insufficient input sanitization and lack of prepared statements allow unauthenticated attackers to append additional SQL queries, potentially leading to extraction of sensitive database information.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS