{"id":"CVE-2026-118420","published":"2026-11-11T06:17:15.220","lastModified":"2026-11-11T06:17:15.320","description":"The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL statement, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/32ef59c1-624c-4a66-9b02-64e730022fc2/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}