wpWax has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 7.1 (high). Most affected products: Directorist: AI-Powered Business Directory, Listings & Classified Ads (2), formgent (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- Directorist: AI-Powered Business Directory, Listings & Classified Ads 2
- formgent 1
Worst active — by depth score
CVE-2026-17092High· 8.1The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.145CVE-2026-94499High· 7.1Subscriber Broken Access Control in FormGent <= 1.12.2 versions.39CVE-2026-100185Medium· 6.4The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient inpu…35
wpWax vulnerabilities
CVEs affecting wpWax, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-100185Medium· 6.4The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient inpu…
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient inpu…
CVE-2026-17092High· 8.1The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a …
CVE-2026-94499High· 7.1Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.