CVE-2023-2277 WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem

What is CVE-2023-2277?

CVE-2023-2277 is a medium-severity vulnerability in wpdirectorykit WP Directory Kit, published on 13 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.

Weakness: CWE-352

Which versions are affected by CVE-2023-2277?

It affects 1 product.

Products include Wpdirectorykit Wp Directory Kit.

How do I fix CVE-2023-2277?

No fix has been published for CVE-2023-2277 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-2277 being exploited?

There is no known exploitation of CVE-2023-2277 in the wild and no public exploit code.

Other vulnerabilities in wpdirectorykit WP Directory Kit

• CVE-2025-13390 WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover Critical 10.0
• CVE-2023-2278 WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action Critical 9.8
• CVE-2024-3217 WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection High 8.8
• CVE-2024-37487 WordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2024-29774 WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hgfm-xg4h-rcg4.