WP Directory Kit <= 1.5.9 - Authenticated (Listing Admin+) Stored Cross-Site Scripting via Search Suggestions
- ID
- WPSEC-2026-2730
- Plugin
- WP Directory Kit (wpdirectorykit)
- Affected
- all versions before 1.6.1
- Remediation
- Update to 1.6.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-08
- Attack surface
- WP Directory Kit on WPSec AttackSurface
- Fix released
- Published
Description
The WP Directory Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the front-end search suggestion feature in all versions up to, and including, 1.5.9. The server returns listing data such as the address without escaping it (and the address is only filtered with wp_kses_post when saved), and wdk_suggestion.js builds the suggestion list by joining strings into HTML, including single-quoted attribute values. This makes it possible for authenticated attackers, with Listing Admin-level access and above, to inject arbitrary web scripts into listing data that execute when a user sees the matching search suggestions.
References
- https://wpsec.com/vuln/WPSEC-2026-2730/
- https://plugins.svn.wordpress.org/wpdirectorykit/tags/1.6.1/
- https://wordpress.org/plugins/wpdirectorykit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS