WP Directory Kit

77 Quality Score

Active Installs

15/30

With roughly 2,000 active installs, WP Directory Kit sits well below the 10,000+ installs of every listed alternative, indicating a niche rather than a mainstream audience.

Update Freshness

25/25

It was updated within the same week of assessment against WordPress 7.0, which is the strongest maintenance signal in the data and pushed this category to a perfect score.

User Rating

15/15

Support Health

8/15

WP Compatibility

15/15

Requiring PHP 7.0 and WordPress 5.2, with testing against WordPress 7.0, gives a very wide compatibility window and a full score here.

Scores higher than 55% of indexed plugins

About

Build your Directory portal, demos for Real Estate Agency and Car Dealership included

Active Installs 2k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-23 6:11pm GMT

Requires WordPress 5.3+

Tested Up To 7.1.2

Requires PHP 7.0+

Security History

37 known vulnerabilities, all patched

2 Critical 8 High 26 Medium 1 Low

Most recent: September 15, 2026

View details ▸

WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter Medium

September 15, 2026 Patched in ["1.5.5"] CVE-2026-16588

Directory Kit <= 1.5.7 - Authenticated (Editor+) SQL Injection Medium

September 12, 2026 Patched in [] CVE-2026-16593

Directory Kit <= 1.5.7 - Authenticated (Contributor+) Information Exposure Medium

September 12, 2026 Patched in [] CVE-2026-16592

Directory Kit <= 1.5.7 - Unauthenticated Information Exposure Medium

September 12, 2026 Patched in [] CVE-2026-18232

WP Directory Kit < 1.5.7 - Unauthenticated Information Exposure Medium

August 21, 2026 Patched in ["1.5.7"] CVE-2026-18231

WP Directory Kit < 1.5.7 - Authenticated (Administrator+) SQL Injection Medium

August 20, 2026 Patched in ["1.5.7"] CVE-2026-18653

Directory Kit <= 1.5.4 - Unauthenticated SQL Injection High

August 12, 2026 Patched in ["1.5.5"] CVE-2026-28001

WP Directory Kit <= 1.5.4 - Unauthenticated SQL Injection Medium

August 11, 2026 Patched in ["1.5.5"] CVE-2026-27538

Directory Kit <= 1.5.5 - Unauthenticated SQL Injection High

August 10, 2026 Patched in ["1.5.6"] CVE-2026-18474

Directory Kit <= 1.5.5 - Authenticated (Subscriber+) SQL Injection Medium

August 10, 2026 Patched in ["1.5.6"] CVE-2026-18230

Directory Kit <= 1.5.4 - Authenticated (Subscriber+) SQL Injection Medium

August 3, 2026 Patched in ["1.5.5"] CVE-2026-16589

Directory Kit <= 1.5.4 - Unauthenticated SQL Injection High

August 3, 2026 Patched in ["1.5.5"] CVE-2026-18473

Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Plugin Settings and API Key Disclosure Medium

August 3, 2026 Patched in ["1.5.5"] CVE-2026-16594

Directory Kit <= 1.5.4 - Information Exposure to Authenticated (Subscriber+) User and Unpublished Listing Disclosure Medium

August 3, 2026 Patched in ["1.5.5"] CVE-2026-16595

Directory Kit <= 1.5.4 - Authenticated (Subscriber+) Contact Message and User Data Disclosure Medium

August 3, 2026 Patched in ["1.5.5"] CVE-2026-16590

WP Directory Kit <= 1.5.1 - Unauthenticated SQL Injection High

May 14, 2026 Patched in ["1.5.2"] CVE-2026-42672

WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection High

April 13, 2026 Patched in ["1.5.1"] CVE-2026-39531

WP Directory Kit <= 1.5.0 - Missing Authorization Medium

April 8, 2026 Patched in ["1.5.1"] CVE-2026-39534

WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action Medium

January 23, 2026 Patched in ["1.5.0"] CVE-2025-13920

WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection High

December 12, 2025 Patched in ["1.4.8"] CVE-2025-13089

WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover Critical

December 3, 2025 Patched in ["1.4.5"] CVE-2025-13390

WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection Medium

December 1, 2025 Patched in ["1.4.7"] CVE-2025-13090

WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter Medium

November 26, 2025 Patched in ["1.4.6"] CVE-2025-13525

WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function High

November 20, 2025 Patched in ["1.4.4"] CVE-2025-13138

WP Directory Kit <= 1.4.0 - Missing Authorization Medium

September 26, 2025 Patched in ["1.4.1"] CVE-2025-60120

WP Directory Kit <= 1.3.5 - Reflected Cross-Site Scripting Medium

July 4, 2024 Patched in ["1.3.6"] CVE-2024-37487

WP Directory Kit <= 1.3.6 - Authenticated (Admin+) HTML Injection Low

June 26, 2024 Patched in ["1.3.7"] CVE-2024-37253

WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection High

April 4, 2024 Patched in ["1.3.1"] CVE-2024-3217

WP Directory Kit <= 1.2.9 - Reflected Cross-Site Scripting Medium

March 25, 2024 Patched in ["1.3.0"] CVE-2024-29774

WP Directory Kit <= 1.2.6 - Missing Authorization Medium

September 5, 2023 Patched in ["1.2.7"] CVE-2023-41875

WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_action Medium

June 12, 2023 Patched in ["1.2.4"] CVE-2023-2351

WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search' Medium

June 1, 2023 Patched in ["1.2.4"] CVE-2023-2835

WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_action Critical

May 26, 2023 Patched in ["1.2.0"] CVE-2023-2278

WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action Medium

May 2, 2023 Patched in ["1.2.3"] CVE-2023-2280

WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem Medium

April 28, 2023 Patched in ["1.2.0"] CVE-2023-2277

WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display Medium

April 28, 2023 Patched in ["1.2.2"] CVE-2023-2279

WP Directory Kit <= 1.1.9 - Open Redirect Medium

April 27, 2023 Patched in ["1.2.0"] CVE-2023-31229

What It Does

WP Directory Kit lets you spin up a directory-style WordPress site with listings, search, and filtering, and it ships with pre-built demos for a real estate agency and a car dealership. It bundles the front-end listing experience and basic portal scaffolding together, so you can launch a niche listings site without assembling separate plugins.

Who It's For

This plugin fits a small business or developer who wants a turnkey directory site for a single vertical (such as properties, vehicles, or local services) and is comfortable starting from one of the bundled demo layouts. It is best suited to sites that do not need deep third-party ecosystem integrations or advanced geolocation features out of the box.

Who Should Skip It

If you are running a large multi-category marketplace or need a mature extensions marketplace, advanced Google Maps integration, or a proven support track record, you should look at one of the alternatives below instead. Sites needing long-form community or moderation tooling will also outgrow this plugin quickly.

The Bottom Line

WP Directory Kit scores 76.98 out of 100, leaning heavily on recent updates and a high user rating while being held back by a small install count and unproven support history. It is a reasonable pick for a single-vertical demo-style directory, but anyone scaling beyond a starter site will likely find the alternatives above a safer bet.

Related Plugins

Classified Listing 87/100

Pick this when you want similar listing functionality plus AI features and a larger install base of about 9,000 active sites.

Directorist 87/100

Choose Directorist if you need a polished front-end dashboard, monetization tools, and a more established 20,000-install ecosystem.

GeoDirectory 86/100

GeoDirectory is the better fit when maps, locations, and multi-location search are central to your directory, since location features are its core strength.

HivePress 80/100

Go with HivePress if you want a modern, themable directory with paid add-ons for bookings, favorites, and messaging on a 10,000-install base.

Link Library 80/100

Link Library is the leaner choice when you only need to organize and display a curated list of links rather than full classified-style listings.