Known vulnerabilities in DirectoryPress – Business Directory And Classified Ad Listing

DirectoryPress is most advanced and flexible directory listing plugin with wide range of features, You can build a business directory, classified list …

12Reported vulnerabilities

9.9Highest CVSS score

3.6.27Latest version

700+Active installs

What to do now

Update DirectoryPress – Business Directory And Classified Ad Listing to 3.6.27 or later. 12 of these have a fixed version available. Updating resolves them.

Plugin last updated: March 4, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-38755	Critical 9.9	0.7%	3.6.10 and earlier	`3.6.11`	July 11, 2024
CVE-2026-3489	High 7.5	0.4%	0 to 3.6.26 (inclusive)	`3.6.27`	April 16, 2026
CVE-2023-37967	High 7.3	0.7%	3.6.2 and earlier	`3.6.3`	July 12, 2023
CVE-2024-32567	High 7.2	0.4%	3.6.7 and earlier	`3.6.8`	April 16, 2024
CVE-2025-62967	Medium 6.4	0.2%	3.6.25 and earlier	`3.6.26`	October 18, 2025
CVE-2024-10584	Medium 5.4	0.3%	Before 3.6.17	`3.6.17`	December 24, 2024
CVE-2026-39566	Medium 5.3	0.2%	3.6.26 and earlier	`3.6.27`	March 23, 2026
CVE-2026-23548	Medium 5.3	0.2%	3.6.25 and earlier	`3.6.26`	December 18, 2025
CVE-2026-27387	Medium 4.3	0.2%	3.6.26 and earlier	`3.6.27`	December 18, 2025
CVE-2025-32249	Medium 4.3	0.2%	3.6.22 and earlier	`3.6.23`	April 4, 2025
CVE-2024-10581	Medium 4.3	0.2%	Before 2.8.0	`2.8.0`	February 15, 2025
CVE-2024-49633	Medium 4.3	0.3%	3.6.19 and earlier	`3.6.20`	January 6, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.