e-plugins Directory Pro vulnerabilities

Latest e-plugins Directory Pro CVEs

Newest publication first

1. CVE-2026-66649 WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability

   Published 2026-08-20

   Critical·CVSS 9.3 EPSS 0.40%

   Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.

2. CVE-2026-27396 WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability

   Published 2026-03-05

   High·CVSS 7.3 EPSS 0.25%

   Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.

3. CVE-2025-64243 WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability

   Published 2025-12-16

   Medium·CVSS 4.3 EPSS 0.22%

   Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.

4. CVE-2025-52748 WordPress Directory Pro plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-10-22

   High·CVSS 7.1 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows Reflected XSS.This issue affects Directory Pro: from n/a through <= 2.5.5.

5. CVE-2025-57948 WordPress Directory Pro Plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-09-22

   Medium·CVSS 6.5 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows DOM-Based XSS.This issue affects Directory Pro: from n/a through <= 2.5.5.

6. CVE-2020-36666 Multiple e-plugins - Subscriber+ Privilege Escalation

   Published 2023-03-27

   High·CVSS 8.8 EPSS 0.91%

   The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.