UL
Product
Ulisting
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 6Medium 7Low 0
Watch
Add Ulisting to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-4381 | 9.8 | Jun 7 | The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the… Affected: before 1.7 |
| CVE-2021-4370 | 9.8 | Jun 7 | The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is… Affected: through 1.6.6 |
| CVE-2021-4343 | 9.8 | Jun 7 | The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6 Affected: through 1.6.6 |
| CVE-2021-4341 | 9.8 | Jun 7 | The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the… Affected: through 1.6.6 |
| CVE-2021-36880 | 9.8 | Sep 27 | Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom Affected: through 2.0.3 |
| CVE-2021-36879 | 9.8 | Sep 27 | Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5) Affected: through 2.0.5 |
| CVE-2025-1653 | 8.8 | Mar 15 | Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation Affected: through 2.1.7 |
| CVE-2025-1657 | 8.8 | Mar 15 | Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection Affected: through 2.1.7 |
| CVE-2021-36876 | 8.8 | Sep 27 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pages Affected: through 2.0.5 |
| CVE-2021-36874 | 8.8 | Sep 27 | Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5) Affected: through 2.0.5 |
| CVE-2021-4346 | 7.5 | Jun 7 | The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6 Affected: through 1.6.6 |
| CVE-2021-4340 | 7.5 | Jun 7 | The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1.6.6 due to insufficient escaping on the… Affected: through 1.6.6 |
| CVE-2021-36877 | 6.5 | Sep 27 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles Affected: through 2.0.5 |
| CVE-2024-47344 | 5.3 | Oct 7 | WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability Affected: 2.1.5 |
| CVE-2021-4357 | 5.3 | Jun 7 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::save_role_api… Affected: through 1.6.6 |
| CVE-2021-4345 | 5.3 | Jun 7 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole::save_role_api method in versions up to,… Affected: through 1.6.6 |
| CVE-2021-4339 | 5.3 | Jun 7 | The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the… Affected: through 1.6.6 |
| CVE-2021-36875 | 4.8 | Sep 27 | Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings WordPress plugin –… Affected: through 2.0.5 |
| CVE-2021-36878 | 4.3 | Sep 27 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update settings Affected: through 2.0.5 |
Showing 19