https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-13390.htmlhttps://patchthecve.com/cve/CVE-2025-13390.htmlSun, 18 Oct 2026 17:10:00 +0000CRITICAL 10.0: The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak tokenhttps://patchthecve.com/cve/CVE-2023-41875.htmlhttps://patchthecve.com/cve/CVE-2023-41875.htmlWed, 17 Jun 2026 06:22:59 +0000MEDIUM 5.3: Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6.https://patchthecve.com/cve/CVE-2024-37487.htmlhttps://patchthecve.com/cve/CVE-2024-37487.htmlWed, 17 Jun 2026 07:38:27 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpdirectorykit.Com WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.3.5.https://patchthecve.com/cve/CVE-2024-37253.htmlhttps://patchthecve.com/cve/CVE-2024-37253.htmlWed, 17 Jun 2026 07:38:00 +0000LOW 2.7: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6.https://patchthecve.com/cve/CVE-2024-29774.htmlhttps://patchthecve.com/cve/CVE-2024-29774.htmlWed, 17 Jun 2026 07:23:03 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpDirectoryKit WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.2.9.