Designinvento's vulnerability footprint centers on DirectoryPress, a narrowly scoped web-based directory application, with recurring exposure around application-layer input handling and access control. The vendor's disclosures skew toward serious outcomes, clustering in weakness classes including cross-site scripting, SQL injection, CSRF, missing authorization, and unrestricted file uploads that are characteristic of web application development. Current severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Designinvento over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-37967CRITICAL Missing Authorization vulnerability in Designinvento DirectoryPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from | Dec 13, 2024 | 9.8 | 31 | NO | NO |
CVE-2024-38755HIGH Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Designinvento DirectoryPress allows SQL Injection.This issue affects Directory | Jul 22, 2024 | 8.8 | 25 | NO | NO |
CVE-2025-62967MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows DOM-Based XSS.This issue af | Oct 27, 2025 | 6.5 | 21 | NO | NO |
CVE-2026-27387MEDIUM Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Direct | Feb 19, 2026 | 5.4 | 19 | NO | NO |
CVE-2026-23548MEDIUM Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Direct | Feb 19, 2026 | 5.3 | 19 | NO | NO |
CVE-2024-49633MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows Reflected XSS.This issue af | Jan 7, 2025 | 6.1 | 18 | NO | NO |
CVE-2024-10584MEDIUM The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and | Dec 24, 2024 | 5.4 | 18 | NO | NO |
CVE-2024-32567MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress allows Reflected XSS.This issue affects Directory | Apr 18, 2024 | 6.1 | 18 | NO | NO |
CVE-2026-39566MEDIUM Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedded Sensitive Data.This | Apr 8, 2026 | 4.3 | 17 | NO | NO |
CVE-2025-32249MEDIUM Cross-Site Request Forgery (CSRF) vulnerability in Designinvento DirectoryPress directorypress allows Cross Site Request Forgery.This issue affects DirectoryPress: from n/a through | Apr 4, 2025 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Designinvento.
Media articles that mention a CVE ID that affects a product developed by Designinvento — matched by CVE ID, not by vendor name.