Skip to content
PluginCanary

WP Directory Kit

by WPDirectoryKit · 2,000+ active installs · Checked 3 Nov 2026
Healthy13 Warnings

Healthy: vulnerability published 30 Oct 2026, fixed in 1.6.1.

81/ 100 Canary Score
Sub-scores for WP Directory Kit
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 1.6.1. Update to version 1.6.1 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 1.6.0. Update to version 1.6.0 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 29 Sep 2026, fixed in 1.5.5. Update to version 1.5.5 or later.29 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 24 Sep 2026, fixed in 1.5.8. Update to version 1.5.8 or later.24 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 15 Sep 2026, fixed in 1.5.5. Update to version 1.5.5 or later.15 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 12 Sep 2026, fixed in 1.6.1. Update to version 1.6.1 or later.12 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 12 Sep 2026, fixed in 1.5.9. Update to version 1.5.9 or later.12 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 21 Aug 2026, fixed in 1.5.7. Update to version 1.5.7 or later.21 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 20 Aug 2026, fixed in 1.5.7. Update to version 1.5.7 or later.20 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 12 Aug 2026, fixed in 1.5.5. Update to version 1.5.5 or later.12 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 11 Aug 2026, fixed in 1.5.5. Update to version 1.5.5 or later.11 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 10 Aug 2026, fixed in 1.5.6. Update to version 1.5.6 or later.10 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 10 Aug 2026, fixed in 1.5.6. Update to version 1.5.6 or later.10 Aug 2026Evidence
  • InfoSEC-329 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master27 Jan 2021 to 27 Jan 2021, 1 commits
listingthemes28 Jan 2021 to 8 Jan 2026, 64 commits
sanwinter17 Oct 2023 to 27 Jun 2024, 14 commits
wpdirectorykit10 Mar 2026 to 16 Oct 2026, 15 commits

4 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
18 days ago
Releases, 24 months
19
Tested up to
7.1 current
Requires PHP
7.0 supported 8.2+
Releases per quarter for WP Directory Kit
Q1 20241
Q2 20246
Q3 20241
Q4 20240
Q1 20250
Q2 20250
Q3 20250
Q4 202510
Q1 20262
Q2 20261
Q3 20265
Q4 20261

Last release 16 Oct 2026. Tested with WordPress 7.1 (current).

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter7.5<= 1.6.01.6.1n/a
9 Oct 2026WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)6.5<= 1.5.91.6.0n/a
29 Sep 2026WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter6.5<= 1.5.41.5.50
24 Sep 2026Directory Kit <= 1.5.7 - Authenticated (Listing Admin+) Stored Cross-Site Scripting6.4<= 1.5.71.5.8n/a
15 Sep 2026WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter6.5<= 1.5.41.5.50
12 Sep 2026Directory Kit <= 1.5.8 - Authenticated (Editor+) SQL Injection4.9<= 1.5.81.5.923
12 Sep 2026Directory Kit <= 1.6.0 - Authenticated (Contributor+) Information Exposure4.3<= 1.6.01.6.1n/a
12 Sep 2026Directory Kit <= 1.6.0 - Unauthenticated Information Exposure5.3<= 1.6.0Not affectedn/a
21 Aug 2026WP Directory Kit < 1.5.7 - Unauthenticated Information Exposure5.3< 1.5.71.5.721
20 Aug 2026WP Directory Kit < 1.5.7 - Authenticated (Administrator+) SQL Injection4.9< 1.5.71.5.722
12 Aug 2026Directory Kit <= 1.5.4 - Unauthenticated SQL Injection7.5<= 1.5.41.5.50
11 Aug 2026WP Directory Kit <= 1.5.4 - Unauthenticated SQL Injection5.9<= 1.5.41.5.50
10 Aug 2026Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection6.5<= 1.5.51.5.63
10 Aug 2026Directory Kit <= 1.5.5 - Unauthenticated SQL Injection7.5<= 1.5.51.5.63
3 Aug 2026Directory Kit <= 1.5.4 - Unauthenticated SQL Injection7.5<= 1.5.41.5.50
3 Aug 2026Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Plugin Settings and API Key Disclosure4.3<= 1.5.41.5.50
3 Aug 2026Directory Kit <= 1.5.4 - Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure4.3<= 1.5.41.5.50
3 Aug 2026Directory Kit <= 1.5.4 - Authenticated (Subscriber+) SQL Injection6.5<= 1.5.41.5.50
3 Aug 2026Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Contact Message and User Data Disclosure4.3<= 1.5.41.5.50
14 May 2026WP Directory Kit <= 1.5.1 - Unauthenticated SQL Injection7.5<= 1.5.11.5.2n/a
13 Apr 2026WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection7.5<= 1.5.01.5.18
8 Apr 2026WP Directory Kit <= 1.5.0 - Missing Authorization5.3<= 1.5.01.5.113
23 Jan 2026WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action5.3<= 1.4.91.5.046
12 Dec 2025WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection7.5<= 1.4.71.4.80
3 Dec 2025WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover101.4.0 to 1.4.41.4.50

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.9 from 35 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star33
4 star1
3 star0
2 star1
1 star0

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Directory Kit
4 May 2026117
11 May 2026267
18 May 2026365
25 May 2026223
1 Jun 2026204
8 Jun 2026167
15 Jun 2026175
22 Jun 2026154
29 Jun 2026207
6 Jul 20261,343
13 Jul 2026268
20 Jul 2026269
27 Jul 20262,270
3 Aug 2026491
10 Aug 20261,740
17 Aug 2026777
24 Aug 2026348
31 Aug 2026262
7 Sep 202666
14 Sep 2026197
21 Sep 20262,321
28 Sep 2026893
5 Oct 20261,802
12 Oct 20261,369
19 Oct 2026877
26 Oct 2026638
2 Nov 202679

Weekly downloads over the last 4 weeks are 12% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Simple Job BoardScore 92 · 10,000+HivePress MessagesScore 91 · 7,000+HivePress ReviewsScore 91 · 7,000+HivePress FavoritesScore 91 · 7,000+HivePress GeolocationScore 91 · 6,000+

Facts

Version1.6.1
AuthorWPDirectoryKit
Added28 Jan 2021
Last updated16 Oct 2026
Active installs2,000+
Requires WordPress5.3
Tested up to7.1.4
Requires PHP7.0
CategoryE-commerce & Shopping
Tagslisting, directory, real-estate, directory plugin, business directory

Other plugins by this author: Classified Ads, Directorykit Car Dealer Addon, Sweet Energy Efficiency, Bikit Business Directory, Add To Home Screen on iOS and PWA

Questions

Is WP Directory Kit still maintained?

WP Directory Kit was last updated on 16 Oct 2026. Its Canary status is Healthy.

Is WP Directory Kit safe?

WP Directory Kit has no open unpatched vulnerabilities on record. 29 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns WP Directory Kit?

The wordpress.org author is WPDirectoryKit. Recent committers: wpdirectorykit, listingthemes, sanwinter, plugin-master. We have recorded no ownership change.

What can I use instead of WP Directory Kit?

Plugins in the same category with a higher Canary Score: Simple Job Board, HivePress Messages, HivePress Reviews, HivePress Favorites, HivePress Geolocation.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue