Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2025-64630

WordPress Business Directory plugin <= 6.4.19 - Broken Access Control vulnerability

Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through <= 6.4.19.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Strategy11 Wordpress
Products
Business Directory Plugin Wordpress
CVE-2025-67596

WordPress Business Directory plugin <= 6.4.19 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Cross Site Request Forgery.This issue affects Business Directory: from n/a through <= 6.4.19.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Strategy11 Wordpress
Products
Business Directory Plugin Wordpress
CVE-2026-2576

Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'payment' parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Strategy11 Wordpress
Products
Business Directory Plugin - Easy Listing Directories Wordpress
CVE-2026-1656

Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification

The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email addresses, by directly referencing the listing ID in crafted requests to the wpbdp_ajax AJAX action.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Strategy11 Wordpress
Products
Business Directory Plugin - Easy Listing Directories Wordpress
CVE-2025-64219

WordPress Business Directory plugin <= 6.4.18 - Broken Access Control vulnerability

Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through <= 6.4.18.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Strategy11 Wordpress
Products
Business Directory Plugin - Easy Listing Directories Wordpress
CVE-2021-24251

Business Directory Plugin < 5.11.2 - Arbitrary Payment History Update

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status (from pending to completed to example)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Strategy11
Products
Business Directory Plugin - Easy Listing Directories
CVE-2021-24250

Business Directory Plugin < 5.11.2 - Authenticated Stored Cross-Site Scripting

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in the label of the Form Fields, leading to Authenticated Stored Cross-Site Scripting issues across various pages of the plugin.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Strategy11
Products
Business Directory Plugin - Easy Listing Directories
CVE-2021-24249

Business Directory Plugin < 5.11.2 - Arbitrary Listing Export

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator export files, which could then be downloaded by the attacker to get access to PII, such as email, home addresses etc

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Strategy11
Products
Business Directory Plugin - Easy Listing Directories
CVE-2021-24248

Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCE

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE

CVSS 3.1 · 7.2 High EPSS 1.6% KEV · Not listed
Vendors
Strategy11
Products
Business Directory Plugin - Easy Listing Directories
CVE-2021-24179

Business Directory Plugin < 5.11 - Arbitrary File Upload to RCE

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Strategy11
Products
Business Directory Plugin - Easy Listing Directories
CVE-2021-24178

Business Directory Plugin < 5.11.1 - Arbitrary Add/Edit/Delete Form Field to Stored XSS

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing an attacker to make a logged in administrator add, edit or delete form fields, which could also lead to Stored Cross-Site Scripting issues.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Strategy11
Products
Business Directory Plugin - Easy Listing Directories