CVE-2026-16589

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes. This allows users with a WP Directory Kit-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.

The WP Directory Kit WordPress plugin through version 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement. This allows authenticated users with access to the page builder (Editor role and above) to perform SQL injection attacks that execute when the affected page is rendered.

The WP Directory Kit WordPress plugin through version 1.5.7 does not check authorization or listing visibility in one of its shortcodes. This allows users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.

The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.

The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the plugin settings including sensitive API keys and secrets.

The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.