e-plugins vulnerabilities

Products

• Directory Pro 2
• Lawyer Directory 1
• wp membership 1

Latest e-plugins CVEs

Newest publication first

1. CVE-2026-66649 WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability

   Published 2026-08-20

   Critical·CVSS 9.3

   Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.

2. CVE-2026-28127 WordPress Lawyer Directory plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

   Published 2026-03-05

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Lawyer Directory lawyer-directory allows Reflected XSS.This issue affects Lawyer Directory: from n/a through <= 1.3.2.

3. CVE-2026-27396 WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability

   Published 2026-03-05

   High·CVSS 7.3

   Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.

4. CVE-2015-4039 WP Membership <= 1.2.3 - Cross-Site Scripting

   Published 2020-01-06

   Medium·CVSS 5.4 Public exploit

   Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the ad...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.