WP Directory Kit

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 62% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from. The recent download trend is too spiky to read.

1. ★★★★★ gazirizgar

   8mo ago

   It would be perfect if it were improved further

   Read on wp.org ↗
2. ★★★★★ jorjsarabia24

   1.1y ago

   Great services thanks

   Read on wp.org ↗
3. ★★★★★ mekletterapeitu

   1.3y ago

   Good plugin, decided to use this one instead similar once i was using before because this looks better and have some better functionality. When i got into some issues support was timely, precise and overall helped me with all issues and bugs.

   Read on wp.org ↗
4. ★★★★★ assassin1717

   1.5y ago

   Easy to set up, highly customizable, and perfect for creating professional directories.

   Read on wp.org ↗
5. ★★★★★ gressi33

   2.0y ago

   You are the best! Thanks a lot for your work! This topic was modified 1 year, 9 months ago by gressi33.

   Read on wp.org ↗
6. ★★★★★ cidcastello

   2.0y ago

   Excelente plugin!

   Read on wp.org ↗
7. ★★★★★ patricioposada

   2.1y ago

   It is a truly pain in the A>> to achieve export listings with acf… You must work in this…

   Read on wp.org ↗
8. ★★★★★ nitroficialiqc

   2.4y ago

   Excelente integración por varias plantillas de WordPress

   Read on wp.org ↗

33 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 5.3 WP Directory Kit < 1.5.7 - Unauthenticated Information Exposure ↗
   2026-08-21 CVE-2026-18231 Exposure of Sensitive Information to an Unauthorized Actor Affects < 1.5.7 Patched in 1.5.7
2. Medium · 4.9 WP Directory Kit < 1.5.7 - Authenticated (Administrator+) SQL Injection ↗
   2026-08-20 CVE-2026-18653 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 1.5.7 Patched in 1.5.7
3. High · 7.5 Directory Kit <= 1.5.4 - Unauthenticated SQL Injection ↗
   2026-08-12 CVE-2026-28001 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.5.4 Patched in 1.5.5
4. Medium · 5.9 WP Directory Kit <= 1.5.4 - Unauthenticated SQL Injection ↗
   2026-08-11 CVE-2026-27538 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.5.4 Patched in 1.5.5
5. High · 7.5 Directory Kit <= 1.5.5 - Unauthenticated SQL Injection ↗
   2026-08-10 CVE-2026-18474 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.5.5 Patched in 1.5.6
6. Medium · 6.5 Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection ↗
   2026-08-10 CVE-2026-18230 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.5.5 Patched in 1.5.6
7. Medium · 4.3 Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Plugin Settings and API Key Disclosure ↗
   2026-08-03 CVE-2026-16594 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.5.4 Patched in 1.5.5
8. Medium · 4.3 Directory Kit <= 1.5.4 - Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure ↗
   2026-08-03 CVE-2026-16595 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.5.4 Patched in 1.5.5
9. Medium · 6.5 Directory Kit <= 1.5.4 - Authenticated (Subscriber+) SQL Injection ↗
   2026-08-03 CVE-2026-16589 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.5.4 Patched in 1.5.5
10. Medium · 4.3 Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Contact Message and User Data Disclosure ↗
    2026-08-03 CVE-2026-16590 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.5.4 Patched in 1.5.5
11. High · 7.5 Directory Kit <= 1.5.4 - Unauthenticated SQL Injection ↗
    2026-08-03 CVE-2026-18473 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.5.4 Patched in 1.5.5
12. High · 7.5 WP Directory Kit <= 1.5.1 - Unauthenticated SQL Injection ↗
    2026-05-14 CVE-2026-42672 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.5.1 Patched in 1.5.2
13. High · 7.5 WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection ↗
    2026-04-13 CVE-2026-39531 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.5.0 Patched in 1.5.1
14. Medium · 5.3 WP Directory Kit <= 1.5.0 - Missing Authorization ↗
    2026-04-08 CVE-2026-39534 Missing Authorization Affects <= 1.5.0 Patched in 1.5.1
15. Medium · 5.3 WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action ↗
    2026-01-23 CVE-2025-13920 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.4.9 Patched in 1.5.0
16. High · 7.5 WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection ↗
    2025-12-12 CVE-2025-13089 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.4.7 Patched in 1.4.8
17. Critical · 10.0 WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover ↗
    2025-12-03 CVE-2025-13390 Incorrect Implementation of Authentication Algorithm Affects 1.4.0 - 1.4.4 Patched in 1.4.5
18. Medium · 4.9 WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection ↗
    2025-12-01 CVE-2025-13090 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.4.6 Patched in 1.4.7
19. Medium · 6.1 WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter ↗
    2025-11-26 CVE-2025-13525 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.4.5 Patched in 1.4.6
20. High · 7.5 WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function ↗
    2025-11-20 CVE-2025-13138 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.4.3 Patched in 1.4.4
21. Medium · 5.3 WP Directory Kit <= 1.4.0 - Missing Authorization ↗
    2025-09-26 CVE-2025-60120 Missing Authorization Affects <= 1.4.0 Patched in 1.4.1
22. Medium · 6.1 WP Directory Kit <= 1.3.5 - Reflected Cross-Site Scripting ↗
    2024-07-04 CVE-2024-37487 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.3.5 Patched in 1.3.6
23. Low · 2.7 WP Directory Kit <= 1.3.6 - Authenticated (Admin+) HTML Injection ↗
    2024-06-26 CVE-2024-37253 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects <= 1.3.6 Patched in 1.3.7
24. High · 8.8 WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection ↗
    2024-04-04 CVE-2024-3217 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.3.0 Patched in 1.3.1
25. Medium · 6.1 WP Directory Kit <= 1.2.9 - Reflected Cross-Site Scripting ↗
    2024-03-25 CVE-2024-29774 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.9 Patched in 1.3.0
26. Medium · 5.3 WP Directory Kit <= 1.2.6 - Missing Authorization ↗
    2023-09-05 CVE-2023-41875 Missing Authorization Affects <= 1.2.6 Patched in 1.2.7
27. Medium · 6.5 WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action ↗
    2023-06-12 CVE-2023-2351 Missing Authorization Affects <= 1.2.3 Patched in 1.2.4
28. Medium · 6.1 WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search' ↗
    2023-06-01 CVE-2023-2835 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.3 Patched in 1.2.4
29. Critical · 9.8 WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action ↗
    2023-05-26 CVE-2023-2278 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.1.9 Patched in 1.2.0
30. Medium · 6.5 WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action ↗
    2023-05-02 CVE-2023-2280 Missing Authorization Affects <= 1.2.2 Patched in 1.2.3
31. Medium · 6.1 WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem ↗
    2023-04-28 CVE-2023-2277 Cross-Site Request Forgery (CSRF) Affects <= 1.1.9 Patched in 1.2.0
32. Medium · 5.4 WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display ↗
    2023-04-28 CVE-2023-2279 Cross-Site Request Forgery (CSRF) Affects <= 1.2.1 Patched in 1.2.2
33. Medium · 5.4 WP Directory Kit <= 1.1.9 - Open Redirect ↗
    2023-04-27 CVE-2023-31229 URL Redirection to Untrusted Site ('Open Redirect') Affects <= 1.1.9 Patched in 1.2.0

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 19 languages, 0 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-05 3K+ → 2K+ down after 318 days in tier
2. 2025-07-22 4K+ → 3K+ down after 342 days in tier
3. 2024-08-14 3K+ → 4K+ up after 3 days in tier
4. 2024-08-11 4K+ → 3K+ down after 1 days in tier
5. 2024-08-10 3K+ → 4K+ up after 286 days in tier
6. 2023-10-29 2K+ → 3K+ up after 212 days in tier
7. 2023-03-31 1K+ → 2K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Directorist: AI-Powered Business Directory, Listings & Classified Ads 20K+ installs · 4.6★ · 3 shared tags A
• GeoDirectory – WP Business Directory Plugin and Classified Listings Directory 10K+ installs · 4.7★ · 3 shared tags A
• HivePress – Business Directory, Listings & Classified Ads Plugin 10K+ installs · 4.8★ · 3 shared tags A
• Classified Listing – AI-Powered Classified ads & Business Directory 9K+ installs · 4.8★ · 3 shared tags A
• Advanced Classifieds & Directory Pro 2K+ installs · 4.6★ · 3 shared tags A
• aDirectory – WP Business Directory Plugin and Classified Ads Listings Directory 300+ installs · 4.4★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for WP Directory Kit into a readme, a review or a deck. It updates itself.

WP Directory Kit: 2K+ active installs, 4.9★ (35 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/wpdirectorykit