Business Directory Plugin – Easy Listing & Member Directories for WordPress

Business Directory Plugin – Easy Listing & Member Directories for WordPress has 23 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 23 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 8 high. 2026 was the busiest year with 9 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 6 of the records (26%). Other recurring categories include Missing Authorization, Cross-Site Scripting.

Every one of the 23 issues recorded for Business Directory Plugin – Easy Listing & Member Directories for WordPress has a vendor fix available, so running the current release closes all known holes.

17 independent researchers contributed these findings, most of them (6) reported by 0xB9. Business Directory Plugin – Easy Listing & Member Directories for WordPress is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891022.11.2011Today11.04.20218.8Business Directory Plugin <= 5.10.1 - Cross-Site Request Forgery to Arbitrary File Upload CVSS 8.8 · 11.04.20218.8Business Directory Plugin < 5.11 - Cross-Site Request Forgery CVSS 8.8 · 11.04.20217.2Business Directory Plugin <= 5.11 - Authenticated PHP4 Upload CVSS 7.2 · 11.04.202112.04.20214.3Business Directory Plugin <= 5.11.1 - Cross-Site Request Forgery to Arbitrary Payment History Update CVSS 4.3 · 12.04.20215.4Business Directory Plugin <= 5.11.1 - Authenticated Stored Cross-Site Scripting CVSS 5.4 · 12.04.20218.8Business Directory Plugin – Easy Listing Directories for WordPress <= 5.11.1 - Cross-Site Request Forgery to Arbitrary Listing Export CVSS 8.8 · 12.04.202128.11.20234.3Business Directory Plugin <= 6.3.10 - Cross-Site Request Forgery CVSS 4.3 · 28.11.202327.12.20235.4Business Directory Plugin <= 6.3.9 - Missing Authorization via dispatch CVSS 5.4 · 27.12.202321.05.20249.8Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter CVSS 9.8 · 21.05.202417.06.20247.4Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection CVSS 7.4 · 17.06.202412.03.20255.3Business Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image Addition CVSS 5.3 · 12.03.202519.10.20254.3Business Directory <= 6.4.18 - Missing Authorization CVSS 4.3 · 19.10.202503.12.20254.3Business Directory <= 6.4.19 - Cross-Site Request Forgery CVSS 4.3 · 03.12.202515.12.20254.3Business Directory <= 6.4.19 - Missing Authorization CVSS 4.3 · 15.12.202517.02.20267.5Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter CVSS 7.5 · 17.02.20265.3Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification CVSS 5.3 · 17.02.202629.06.20266.4Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 29.06.20267.2Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.22 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 29.06.20265.3Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.23 - Missing Authorization CVSS 5.3 · 29.06.202628.07.20266.4Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 28.07.202612.08.20267.2Business Directory <= 6.4.25 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 12.08.202603.09.20265.3Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.26 - Unauthenticated Insecure Direct Object Reference CVSS 5.3 · 03.09.20265.3Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.26 - Missing Authorization CVSS 5.3 · 03.09.2026

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

23

Get automatic notifications for all Business Directory Plugin – Easy Listing & Member Directories for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2024-4443

Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter

Read the full analysis

Vulnerability Records

23 records
2026-09-03 00:00CVE-2026-84769
5.3
Medium
sungbyeongchanYes
2026-09-03 00:00CVE-2026-84758
5.3
Medium
nh4tvdYes
2026-08-12 00:00CVE-2026-28004
7.2
High
Minhyeok LeeYes
2026-07-28 00:00CVE-2026-61959
6.4
Medium
Mukhlis AmienYes
2026-06-29 00:00CVE-2026-57328
6.4
Medium
she11fYes
2026-06-29 00:00CVE-2026-57326
7.2
High
Saleh Elsayed (0xManticore)Yes
2026-06-29 00:00CVE-2026-57339
5.3
Medium
John UmoruYes
2026-02-17 20:07CVE-2026-1656
5.3
Medium
Sein LinnYes
2026-02-17 16:02CVE-2026-2576
7.5
High
Sein LinnYes
2025-12-15 00:00CVE-2025-64630
4.3
Medium
darooYes
Showing 1–10 of 23 reports
Business Directory Plugin – Easy Listing & Member Directories for WordPress banner
Latestv6.4.27

Business Directory Plugin – Easy Listing & Member Directories for WordPress

Strategy11 Team

Author

Strategy11 Team

4.6(504)
92/100
Last Updated
2026-09-01 (12d ago)
Active Installs
10,000+
Downloads
1,880,133
Requires WP
5.9+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2011-11-22 (15y ago)

Build a business directory or member directory on WordPress, complete with a listing manager and directory website builder. No developer needed. Business Directory Plugin for WordPress The Business Directory Plugin is the easy WP directory plugin for building a business directory or member directory without writing a line of code. Run a restaurant directory for your town, or a staff directory for your own team, and it’s live in minutes. If you’re not a developer, no problem. This WordPress directory plugin doesn’t require any coding knowledge. Activate it, then click the setup notice’s “Create required pages for me” button, and your directory page is live with the [businessdirectory] shortcode already in place. Need to show listings somewhere else, too? Drop the [businessdirectory-listings] shortcode into any page to display a specific category or tag, or add the Featured, Latest, Random, or Search widgets to any sidebar. See the full shortcode reference for everything else you can do. See a live demo. Business Directory Plugin Premium Plans This free plugin covers the core of your business directory. Paid annual plans add features like Google Maps, ZIP code search, ratings and reviews, claim listings, and discount codes. Which ones you get depends on the plan. See plans and pricing. If Business Directory Plugin is working well for you, leave a review to help other directory builders find it too. An Easy WordPress Directory Website Builder Already have a list of businesses, staff, or members in a spreadsheet? Import it in one upload instead of typing every entry by hand. Add whatever fields your directory needs, like a phone number, hours, a price range, or a photo. Take the listings you want and build almost any kind of directory: a real estate listings site like Zillow, a local business directory like Google Business Profile, a services marketplace like Thumbtack, a connections directory for an address book, a web directory for curated local links, or a book review site like Goodreads. It’s a listing manager and directory website builder for whatever you build. Need a classifieds listings site instead? Try Another WordPress Classifieds Plugin – AWPCP. Build a Member Directory or Company Directory Build more than business listings: a team directory, company directory, medical directory, or any other kind of listing site. Use the same plugin as a member directory for an association, a staff directory or employee directory for your company, a chamber of commerce business directory, or a professional directory for any licensed trade. The setup works the same way no matter who’s listed. Simple Listing Solutions for Every Community The Business Directory Plugin has thousands of users. Here are a few things they’ve already created with this listing manager and directory website builder. Start a listing manager service for providers: counselors, plumbers, electricians, house cleaners, locksmiths, therapists, wedding vendors, veterinarians, consultants, photographers, artists, and authors. Build a ratings-and-reviews directory for local recommendations, connecting travelers to hotels, tours, local businesses, and other visitor attractions. Help a city or small community find local resources: sporting club listings, a church directory, local farms with produce, or a chamber of commerce business directory. Advertise businesses and sell listings directly to the owners. Offer a member directory as a paid membership perk. Build a faculty or staff directory for a school, department, or university. Build the directory your niche doesn’t have yet. Accept Payments for Directory Listings Choose how your directory earns. Offer free listings or paid plans, one-time or recurring, and assign different plans to different categories so premium listings and free listings live side by side. Add featured or sticky placement as a paid upgrade. Stripe and Authorize.net both process real payments in the free plugin. You don’t need a paid plan for either one. Stripe comes with pay-as-you-go pricing (3% per-transaction, on top of Stripe’s own fees) until you upgrade to a paid plan. Authorize.net has no per-transaction fee, ever. Every plan and price stays fully in your control from your own WordPress dashboard. Full Free WordPress Listing Plugin Features This WordPress listing plugin handles the basics free: form fields, image uploads, search, and payments included. See the full list of Business Directory Plugin features. The free plugin has no listing limit and no trial period. Create as many listings as you want, for as long as you want, at no cost. Fully customizable form fields for every business listing Upload images per listing, with limits set by plan Drag-and-drop image uploads, easy reordering, primary image settings, and thumbnail sizing Accept paid or free listings with Stripe and Authorize.net Full support for recurring payments on paid listings Featured and sticky listings available as a paid upgrade Widgets for Featured, Latest, and Random listings, plus a Search widget Multiple listing plans, assignable by category Built-in CSV import and export for fast directory listing creation Block spam listings with reCAPTCHA Sorting options for categories, listings, and front-end search Listing owners edit their own listings without WP dashboard access SEO friendly with Yoast SEO, Rank Math, or All in One SEO Quick-search and sorting bar for simple directory searches Advanced search screen with configurable visible fields Mobile-friendly and responsive with any well-built WordPress theme Multilingual directories with WPML Integrates with popular plugins like NavXT Breadcrumbs and WP-PageNavi Full Premium Directory Plugin Features The free plugin already runs a complete directory on its own. These premium directory software features are there when you want more control over payments, categories, and search. File Upload – let listing owners attach PDFs, text files, and images to their listings. Ratings and Reviews – connect reviews to each listing, with Schema.org markup. It’s a WordPress review plugin built right into your directory. Enhanced Categories – show images or icons with categories, including parent-child category structures. Google Maps – show each listing’s location on a map, with custom sizes for category pages, search results, and listing details. ZIP Code Search – ZIP code and postal code radius and proximity search, supporting a number of countries. Regions – filter listing results by location, so visitors can browse by area. Discount Codes – offer percentage or fixed-amount discounts on paid listings, with expiration dates. Claim Listings – publish claimable listings that other users pay (or don’t) to claim as their own. Restrictions – assign features to your paid or sticky listing plans, giving your customers a reason to upgrade. See plans and pricing. Payment Gateways for Paid Listings Stripe and Authorize.net both come included with the free plugin. Connect Stripe with one click, or add your Authorize.net credentials in settings, to turn either one on. Stripe runs on pay-as-you-go pricing: a 3% fee on each transaction, on top of Stripe’s own processing fees. Upgrading your license removes that 3% fee. PayPal and PayFast are available on premium plans: PayPal Gateway – give buyers another way to pay if they already have a PayPal account. PayFast Gateway – accept payments through PayFast, a popular gateway for South African businesses. Premium Directory Themes Transform your WP directory site the easy way, in a few clicks. These business directory templates are designed to style your listings without taking over as a full WordPress theme. Elegant Grid Theme Modern Theme Business Card Theme Tabbed Theme Elegant Theme Mobile Compact Theme Built by Strategy11 The Business Directory Plugin has helped WordPress site owners build business directories and member directories since 2011, with more than 10,000 active installs and a 4.6-star average across 500+ ratings today. Support comes from a small team that reads and answers tickets personally instead of routing you through tiers — when something breaks, you talk to someone who fixes it. Better Than Hosted Directory Software & Membership Platforms If you’ve looked into directory software before, you’ve probably run into a hosted directory or membership platform. Most lock your business directory behind a monthly SaaS fee and someone else’s server. The Business Directory Plugin runs on your own WordPress site. You own your listings, your member directory, and your data, with no recurring platform tax just to keep your web directory online. The core plugin stays free forever. Premium plans start at $99/year, backed by a 14-day money-back guarantee. Branding Guidelines The Business Directory Plugin is a product of Strategy11. When writing about this WordPress directory plugin, please use the correct branding: Business Directory Plugin (correct) BD Plugin (correct, short form) BusinessDirectoryPlugin (incorrect – no spaces) business directory plugin (incorrect – not capitalized) Business Directory Plugin Resources Documentation Quick Start Guide YouTube Videos Live Demo

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C