# cve.now: E-plugins

The newest entries naming E-plugins as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-66649](https://cve.now/CVE-2026-66649.md): WordPress Directory Pro plugin \<= 2.5.8 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-28127](https://cve.now/CVE-2026-28127.md): WordPress Lawyer Directory plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-27396](https://cve.now/CVE-2026-27396.md): WordPress Directory Pro plugin \<= 2.5.6 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69293](https://cve.now/CVE-2025-69293.md): WordPress Final User plugin \<= 1.2.5 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-69292](https://cve.now/CVE-2025-69292.md): WordPress WP Membership plugin \<= 1.6.4 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-69193](https://cve.now/CVE-2025-69193.md): WordPress WP Membership plugin \<= 1.6.4 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69192](https://cve.now/CVE-2025-69192.md): WordPress Real Estate Pro plugin \<= 2.1.5 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69191](https://cve.now/CVE-2025-69191.md): WordPress ListingHub plugin \<= 1.2.7 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69190](https://cve.now/CVE-2025-69190.md): WordPress Listihub theme \<= 1.0.6 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69188](https://cve.now/CVE-2025-69188.md): WordPress fitness-trainer plugin \<= 1.7.1 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69187](https://cve.now/CVE-2025-69187.md): WordPress Final User plugin \<= 1.2.5 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69186](https://cve.now/CVE-2025-69186.md): WordPress Hospital Doctor Directory plugin \<= 1.3.9 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69185](https://cve.now/CVE-2025-69185.md): WordPress Hotel Listing plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69184](https://cve.now/CVE-2025-69184.md): WordPress Institutions Directory plugin \<= 1.3.4 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69183](https://cve.now/CVE-2025-69183.md): WordPress Hospital Doctor Directory plugin \<= 1.3.9 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-69182](https://cve.now/CVE-2025-69182.md): WordPress Institutions Directory plugin \<= 1.3.4 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-69181](https://cve.now/CVE-2025-69181.md): WordPress Lawyer Directory plugin \<= 1.3.4 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2025-69056](https://cve.now/CVE-2025-69056.md): WordPress Hotel Listing plugin \<= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-68059](https://cve.now/CVE-2025-68059.md): WordPress Hotel Listing plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 7.6)
- [CVE-2025-68058](https://cve.now/CVE-2025-68058.md): WordPress Institutions Directory plugin \<= 1.3..4 - Broken Access Control vulnerability (CVSS 7.6)
- [CVE-2025-68057](https://cve.now/CVE-2025-68057.md): WordPress Hospital Doctor Directory plugin \<= 1.3.9 - Broken Access Control vulnerability (CVSS 7.6)
- [CVE-2025-67967](https://cve.now/CVE-2025-67967.md): WordPress Lawyer Directory plugin \<= 1.3.3 - Broken Access Control vulnerability (CVSS 7.6)
- [CVE-2025-67966](https://cve.now/CVE-2025-67966.md): WordPress Lawyer Directory plugin \<= 1.3.3 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-13504](https://cve.now/CVE-2025-13504.md): WordPress Real Estate Pro plugin \<= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-12551](https://cve.now/CVE-2025-12551.md): WordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-69085](https://cve.now/CVE-2025-69085.md): WordPress JobBank plugin \<= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-58710](https://cve.now/CVE-2025-58710.md): WordPress Hotel Listing plugin \<= 1.4.0 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-64243](https://cve.now/CVE-2025-64243.md): WordPress Directory Pro plugin \<= 2.5.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-58638](https://cve.now/CVE-2025-58638.md): WordPress Institutions Directory Plugin \<= 1.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- [CVE-2025-52748](https://cve.now/CVE-2025-52748.md): WordPress Directory Pro plugin \<= 2.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- [CVE-2025-57948](https://cve.now/CVE-2025-57948.md): WordPress Directory Pro Plugin \<= 2.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-54717](https://cve.now/CVE-2025-54717.md): WordPress WP Membership Plugin \<= 1.6.3 - Settings Change Vulnerability (CVSS 5.4)
- [CVE-2024-10547](https://cve.now/CVE-2024-10547.md): WP Membership \<= 1.6.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/e-plugins
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.