CVE-2026-118418

MediumCVSS 5.3/10Last modified Nov 11, 2026

Description

The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1184206.8The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL statement, making it po CVE-2026-1184216.8The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its adm CVE-2026-1184227.1The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream end CVE-2026-11842310.0The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticat CVE-2026-1184256.8A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occur CVE-2026-1184265.3In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search CVE-2026-1184355.4Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.CVE-2026-1184373.7The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauth CVE-2026-1184386.8The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser,CVE-2026-1184394.1The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a use CVE-2026-118444.9The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Read vulnerability, allowing privileged rem CVE-2026-1184444.8Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The n