CVE-2025-13525

Published November 27th, 2025

View on NVD ↗

CVSS v3

6.1

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

WP Directory Kit

Very easy to use and install, plugin will allow you to manage Listings, Categories, Fields from your admin dashboard. As part of project solution we also build WordPress Theme for Real Estate Agency: <a href="https://wpdirectorykit.com/themes/nexproperty.html" rel="nofollow ugc">NexProperty – Property WordPress Theme</a> <a href="https://wpdirectorykit.com/themes/real-estate-golden.html" rel="nofollow ugc">Real Estate Golden – WordPress Theme</a> <a href="https://wpdirectorykit.com/themes/moison.html" rel="nofollow ugc">Realtor Directory Moison – WordPress Real Estate Theme</a> <a href="https://wpdirectorykit.com/themes/apartment.html" rel="nofollow ugc">Apartment – WordPress Real Estate Theme</a> <a href="https://wpdirectorykit.com/themes/real-estate-villa.html" rel="nofollow ugc">Villa – WordPress Real Estate Theme</a> <a href="https://wpdirectorykit.com/themes/real-estate-dark-house.html" rel="nofollow ugc">Dark House – WordPress Real Estate Theme</a> <a href="https://wpdirectorykit.com/themes/real-estate-realista.html" rel="nofollow ugc">Real Estate Realista – WordPress Theme</a> <a href="https://wpdirectorykit.com/themes/real-estate-yillow.html" rel="nofollow ugc">Real Estate Yillow – WordPress Theme</a> WordPress Theme for Car Dealers, <a href="https://wpdirectorykit.com/themes/car-dealer-nexcars.html" rel="nofollow ugc">NexCars</a> WordPress Theme for Classified ADS, <a href="https://www.wpdirectorykit.com/themes/classified-ads-directory.html" rel="nofollow ugc">Classified ADS</a> Full-Service Real Estate Website Solution for your Apartment, Villa, House, basic tourism services, or even a complete Agency based on WP Directory Kit, <a href="https://webapartman.com/" rel="nofollow ugc">WebApartman.com</a> Can be also used for Business Directory, Store Locator, Classified Ads, Doctors Directory, Job Portal or any other type of Directory. Almost everything possible to design visually in Elementor, including front pages, resutls pages, listing preview pages etc. Visual designing support for search form and result item/cards. More info on <a href="https://wpdirectorykit.com/" rel="nofollow ugc">wpdirectorykit.com</a> Documentation: <a href="http://wpdirectorykit.com/documentation/" rel="nofollow ugc">http://wpdirectorykit.com/documentation/</a> <h3>Videos</h3> <iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/ILVXyiIt1PI?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe> <iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/cewZBOGzbPg?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe> <iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/NhAHlMg-hpQ?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe> <h3>Features</h3> <ul> <li>Manage Listings</li> <li>Manage Categories</li> <li>Manage Fields</li> <li>Different fields based on category</li> <li>Select listings agent</li> <li>Manage indoor amenities</li> <li>Manage outdoor amenities</li> <li>Listing plans</li> <li>Galleries and Sliders on Listing Preview</li> <li>Multi category and locations search</li> <li>Multimedia fields integration</li> <li>Result items support video and slider</li> <li>Price range search slider</li> <li>Translatable to any language</li> <li>Multiple agents, categories, listings support</li> <li>Full Elementor compatibility</li> <li>Messaging support</li> <li>Demo data import for Real Estate and Car Dealership</li> <li>Open street maps support</li> <li>Energy efficiency plugin available here: <a href="https://wordpress.org/plugins/sweet-energy-efficiency/" rel="ugc">Download</a></li> </ul> <h3>Premium PAID addons / plugins / features available</h3> <a href="http://wpdirectorykit.com/plugins.html" rel="nofollow ugc">Official Premium Addons Here</a> <ul> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-membership.html" rel="nofollow ugc">Membership Subscriptions & Features</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-booking-calendar.html" rel="nofollow ugc">Booking & Calendar</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-import-export.html" rel="nofollow ugc">Import/Export from other portal, idx or similar</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-multy-currency.html" rel="nofollow ugc">Multi Currency</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-favorites.html" rel="nofollow ugc">Favorites</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-review-system.html" rel="nofollow ugc">Review system</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-profile-picture-uploader.html" rel="nofollow ugc">Profile picture uploader</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-mortgage-loan-calculator.html" rel="nofollow ugc">Mortgage Calculator</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-facebook.html" rel="nofollow ugc">Facebook Comments</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-mailchimp.html" rel="nofollow ugc">Mailchimp integration</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-report-abuse.html" rel="nofollow ugc">Report Abuse</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-payments.html" rel="nofollow ugc">Listing Payments</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-compare-listings.html" rel="nofollow ugc">Compare Listings</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-save-search.html" rel="nofollow ugc">Save Search with Email Alerts</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-duplicate-listing.html" rel="nofollow ugc">Duplicate Listing</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-pdf-download.html" rel="nofollow ugc">PDF Download</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-listing-claim.html" rel="nofollow ugc">Claim / Take Ownership</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-svg-map.html" rel="nofollow ugc">WDK Svg Maps</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-geo-coding.html" rel="nofollow ugc">WDK Geo Coding</a></li> <li><a href="https://wpdirectorykit.com/plugins/wp-directory-messages-chat.html" rel="nofollow ugc">WDK Live Messages Chat</a></li> <li><a href="https://wpdirectorykit.com/mobile-app.html" rel="nofollow ugc">Mobile Apps for iOS and Android</a></li> </ul> Contact for security issues: https://wpdirectorykit.com/contact/ <h3>Credits</h3> <ul> <li>Stocksnap Images </li> <li>License: StockSnap’s CC0 License</li> <li> Source: https://stocksnap.io/license https://stocksnap.io/photo/interior-design-478BZDEA2Y https://stocksnap.io/photo/house-interior-APBDJIC32G https://stocksnap.io/photo/apartment-bed-EGXWIV409M https://stocksnap.io/photo/sea-ocean-62BFZ9QZUZ </li> <li> License: CC0 License </li> <li> Source: https://pxhere.com/license https://pxhere.com/en/photo/713542 https://pxhere.com/en/photo/925637 https://pxhere.com/en/photo/862253 https://pxhere.com/en/photo/1642266 https://pxhere.com/en/photo/486169 https://pxhere.com/en/photo/1073943 https://pxhere.com/en/photo/1292551 https://pxhere.com/en/photo/1013940 https://pxhere.com/en/photo/1598623 https://pxhere.com/en/photo/1076934 https://pxhere.com/en/photo/1600892 https://pxhere.com/en/photo/941745 https://pxhere.com/en/photo/941746 https://pxhere.com/en/photo/600695 https://pxhere.com/en/photo/863007 https://pxhere.com/en/photo/1389997 https://pxhere.com/en/photo/599832 https://pxhere.com/en/photo/1284562 https://pxhere.com/en/photo/816902 https://pxhere.com/en/photo/670069 https://pxhere.com/en/photo/670068 https://pxhere.com/en/photo/1364746 https://pxhere.com/en/photo/606815 https://pxhere.com/en/photo/516507 https://pxhere.com/en/photo/1632922 https://pxhere.com/en/photo/1208091 https://pxhere.com/en/photo/1015789 https://pxhere.com/en/photo/715744 https://pxhere.com/en/photo/742706 https://pxhere.com/en/photo/459445 https://pxhere.com/en/photo/1601256 https://pxhere.com/en/photo/67776 https://pxhere.com/en/photo/1142138 https://pxhere.com/en/photo/804292 https://pxhere.com/en/photo/1601230 https://pxhere.com/en/photo/157662 https://pxhere.com/en/photo/1629377 https://pxhere.com/en/photo/282629 https://pxhere.com/en/photo/1166111 https://pxhere.com/en/photo/17001 https://pxhere.com/en/photo/733256 https://pxhere.com/en/photo/978943 https://pxhere.com/en/photo/1080730 https://pxhere.com/en/photo/1214210 https://pxhere.com/en/photo/1068912 https://pxhere.com/en/photo/1444777 https://pxhere.com/en/photo/537172 https://pxhere.com/en/photo/720964 https://pxhere.com/en/photo/759959 https://pxhere.com/en/photo/1179825 https://pxhere.com/en/photo/1179825 https://pxhere.com/en/photo/1592155 https://pxhere.com/en/photo/1603984 https://pxhere.com/en/photo/348208 https://pxhere.com/en/photo/990593 https://pxhere.com/en/photo/26750 https://pxhere.com/en/photo/536373 https://pxhere.com/en/photo/449291 https://pxhere.com/en/photo/918267 https://pxhere.com/en/photo/722779 https://pxhere.com/en/photo/1402258 https://pxhere.com/en/photo/1188450 https://pxhere.com/en/photo/1054869 https://pxhere.com/en/photo/1573331 https://pxhere.com/en/photo/1573329 https://pxhere.com/en/photo/1629588 https://pxhere.com/en/photo/285 https://pxhere.com/en/photo/818653 https://pxhere.com/en/photo/399720 https://pxhere.com/en/photo/661976 </li> <li> License: CC0 License </li> <li> Source: https://stocksnap.io/license https://stocksnap.io/photo/parkinggarage-parkingspaces-8U9IMYL2CQ https://stocksnap.io/photo/woman-smartphone-MLEPUKHYUU https://stocksnap.io/photo/business-man-DAAZROYMQN https://stocksnap.io/photo/business-man-XTVALHTBUK https://stocksnap.io/photo/senior-business-UTEZRDTKPP https://stocksnap.io/photo/business-man-IVZBYWKEFM https://stocksnap.io/photo/older-businessman-5BRQF1DZ8W </li> <li> Slick </li> <li>Author: Ken Wheeler</li> <li>License: MIT</li> <li> Source: Website: http://kenwheeler.github.io Docs: http://kenwheeler.github.io/slick Repo: http://github.com/kenwheeler/slick Issues: http://github.com/kenwheeler/slick/issues </li> <li> Blueimp </li> <li>Author: Sebastian Tschan</li> <li>License: MIT</li> <li> Source: Website: https://blueimp.github.io/Gallery/ Docs: https://github.com/blueimp/Gallery/blob/master/README.md Repo: https://github.com/blueimp/Gallery Issues: https://github.com/blueimp/Gallery/issues </li> <li> Confirm </li> <li>Author: Boniface Pereira</li> <li>License: MIT</li> <li> Source: Website: https://craftpip.github.io/jquery-confirm/ Docs: https://craftpip.github.io/jquery-confirm/ Repo: https://github.com/craftpip/jquery-confirm Issues: https://github.com/craftpip/jquery-confirm/issues </li> <li> Confirm </li> <li>Author: Ion.RangeSlider</li> <li>License: MIT</li> <li>Source: Website: http://ionden.com/a/plugins/ion.rangeSlider Docs: http://ionden.com/a/plugins/ion.rangeSlider/start.html Repo: https://github.com/IonDen/ion.rangeSlider Issues: https://github.com/IonDen/ion.rangeSlider/issues</li> </ul>

WordPress Plugin Directory

101K