Web Directory Free vulnerabilities

Unauthenticated SQL Injection vulnerability in Web Directory Free versions up to 1.7.13. An attacker can execute arbitrary SQL queries without authentication.

The Web Directory Free plugin for WordPress up to version 1.7.13 is vulnerable to generic SQL Injection via the 'levels' parameter. Insufficient input sanitization and lack of prepared statements allow unauthenticated attackers to append additional SQL queries, potentially leading to extraction of sensitive database information.

A DOM-Based Cross-site Scripting vulnerability in the Web Directory Free plugin (versions up to and including 1.7.12) arises from improper neutralization of input during web page generation. An attacker can inject a malicious script that executes in the user's browser.