VULNERABILITY INTELLIGENCE

CVE-2026-18474

CVSS score8.6 HIGH

EPSS probability0.45%

CISA KEVNot currently listed

Published2026-08-12

Last modified2026-08-26

Description

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.