CVE-2026-16591
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes. This allows users with a WP Directory Kit-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.
Risk Assessment
A user with a limited role can inject persistent malicious JavaScript that executes for all visitors of the affected page. This risks session theft and account takeover.
Recommendation
Update the WP Directory Kit plugin to version 1.5.8 or later. Review existing category and location entries for injected code.
Other vulnerabilities in WP Directory Kit WordPress plugin
See all- CVE-2026-16593Medium
The WP Directory Kit WordPress plugin through version 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement. This allows authenticated users with access to the page builder (Editor role and above) to perform SQL injection attacks that execute when the affected page is rendered.
- CVE-2026-16592Low
The WP Directory Kit WordPress plugin through version 1.5.7 does not check authorization or listing visibility in one of its shortcodes. This allows users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
- CVE-2026-16595Medium
The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
- CVE-2026-16594High
The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the plugin settings including sensitive API keys and secrets.
- CVE-2026-16590Medium
The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
- CVE-2026-16589High
The WP Directory Kit WordPress plugin before version 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks. This allows any authenticated user such as a Subscriber to perform SQL injection attacks.
Original NVD description (English source)
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS