CVE-2026-16593: Unknown Wp Directory Kit

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.

Affected products

• Unknown Wp Directory Kit: up to and including 1.5.7

Published 2026-09-15. Last modified 2026-09-16.