https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-10581.htmlhttps://patchthecve.com/cve/CVE-2024-10581.htmlWed, 17 Jun 2026 06:55:58 +0000MEDIUM 4.3: The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfl_listingStatusChange() function. This makes it possible for unauthenticated attackers to update lihttps://patchthecve.com/cve/CVE-2024-49633.htmlhttps://patchthecve.com/cve/CVE-2024-49633.htmlWed, 17 Jun 2026 08:00:11 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows Reflected XSS.This issue affects DirectoryPress: from n/a through <= 3.6.19.https://patchthecve.com/cve/CVE-2024-10584.htmlhttps://patchthecve.com/cve/CVE-2024-10584.htmlWed, 17 Jun 2026 06:55:58 +0000MEDIUM 5.4: The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.6.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated ahttps://patchthecve.com/cve/CVE-2023-37967.htmlhttps://patchthecve.com/cve/CVE-2023-37967.htmlWed, 17 Jun 2026 06:09:01 +0000MEDIUM 6.5: Missing Authorization vulnerability in Designinvento DirectoryPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through 3.6.2.https://patchthecve.com/cve/CVE-2024-38755.htmlhttps://patchthecve.com/cve/CVE-2024-38755.htmlWed, 17 Jun 2026 07:41:00 +0000HIGH 8.5: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Designinvento DirectoryPress allows SQL Injection.This issue affects DirectoryPress: from n/a through 3.6.10.