Shamalli vulnerabilities

Products

• Web Directory Free 6
• Web 2.0 Directory plugin for WordPress 1

Latest Shamalli CVEs

Newest publication first

1. CVE-2026-15272 Web 2.0 Directory <= 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_filter' Parameter

   Published 2026-10-31

   Medium·CVSS 6.5 EPSS 0.32%

   The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter in all versions up to, and including, 2.10.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

2. CVE-2026-28142 WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability

   Published 2026-08-13

   Critical·CVSS 9.3 EPSS 0.40%

   Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

3. CVE-2025-69018 WordPress Web Directory Free plugin <= 1.7.12 - Cross Site Scripting (XSS) vulnerability

   Published 2025-12-30

   Medium·CVSS 6.5 EPSS 0.16%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.

4. CVE-2025-39567 WordPress Web Directory Free plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-04-17

   High·CVSS 7.1 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through <= 1.7.8.

5. CVE-2025-30908 WordPress Web Directory Free plugin <= 1.7.6 - CSRF to Cross Site Scripting (XSS) vulnerability

   Published 2025-04-03

   High·CVSS 7.1 EPSS 0.16%

   Cross-Site Request Forgery (CSRF) vulnerability in Shamalli Web Directory Free web-directory-free allows Stored XSS.This issue affects Web Directory Free: from n/a through <= 1.7.6.

6. CVE-2025-28904 WordPress Web Directory Free plugin <= 1.7.6 - SQL Injection vulnerability

   Published 2025-03-25

   Critical·CVSS 9.3 EPSS 0.36%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shamalli Web Directory Free web-directory-free allows Blind SQL Injection.This issue affects Web Directory Free: from n/a through <= 1.7.6.

7. CVE-2024-47379 WordPress Web Directory Free plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2024-10-05

   High·CVSS 7.1 EPSS 0.32%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through <= 1.7.3.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.