All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-18474
HIGHpublished 2026-08-12 06:20 UTC · 21 hours ago · modified 2026-08-12 13:17 UTC
8.6
CVSS / 10
// description
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.
// weaknesses (CWE)
- CWE-89