Extension WordPress
Vulnérabilités Directory Listings WordPress plugin – uListing
Cette page rassemble les failles publiées pour Directory Listings WordPress plugin – uListing, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Directory Listings WordPress plugin – uListing
26 fiches
Directory Listings WordPress plugin – uListing <= 2.2.0 – Authenticated (Editor+) Arbitrary File Download
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with Editor-level access and above, to read the…
*-2.2.0
Non indiqué
26/02/2026
uListing <= 2.2.0 – Authenticated (Administrator+) PHP Object Injection
The uListing plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a…
*-2.2.0
Non indiqué
22/04/2025
uListing <= 2.2.0 – Authenticated (Subscriber+) PHP Object Injection
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.0 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level…
*-2.2.0
Non indiqué
15/04/2025
uListing <= 2.1.9 – Authenticated (Administrator+) SQL Injection
The uListing plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…
*-2.1.9
Non indiqué
04/04/2025
Directory Listings WordPress plugin – uListing <= 2.2.0 – Authenticated (Subscriber+) Privilege Escalation
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user…
*-2.2.0
Non indiqué
14/03/2025
Directory Listings WordPress plugin – uListing <= 2.2.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and…
*-2.2.0
Non indiqué
14/03/2025
uListing <= 2.1.6 – Unauthenticated SQL Injection
The uListing plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…
*-2.1.6
2.1.7
03/02/2025
uListing <= 2.1.6 – Authenticated (Contributor+) SQL Injection
The uListing plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…
*-2.1.6
2.1.7
03/02/2025
uListing <= 2.1.5 – Unauthenticated Information Exposure
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.5 via the /pricing-plan/payment endpoint. This makes it possible for unauthenticated attackers to render the pricing…
*-2.1.5
2.1.6
27/09/2024
uListing <= 1.6.6 – Unauthenticated SQL Injection
The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1.6.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
[*, 1.7)
1.7
28/10/2021
Listing, Classified Ads & Business Directory – uListing <= 2.0.8 – Cross-Site Request Forgery
The Listing, Classified Ads & Business Directory – uListing plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.8. This is due to missing or incorrect nonce validation on several functions. This…
*-2.0.8
2.0.9
06/09/2021
Listing, Classified Ads & Business Directory – uListing <= 2.0.5 – Privilege Escalation
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions
*-2.0.5
2.0.6
27/07/2021
uListing <= 2.0.5 – Cross-Site Request Forgery leading to Settings Change
The Cross-Site Request Forgery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to make changes to the plugin's settings via forged request granted…
*-2.0.5
2.0.6
27/07/2021
Listing, Classified Ads & Business Directory – uListing <= 2.0.5 – Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions
*-2.0.5
2.0.6
27/07/2021
Listing, Classified Ads & Business Directory – uListing <= 2.0.5 – Cross-Site Request Forgery
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions
*-2.0.5
2.0.6
27/07/2021
Listing, Classified Ads & Business Directory – uListing <= 2.0.5 – Reflected Cross-Site Scripting
Authenticated Reflected Cross-Site Scripting (XSS) vulnerability in WordPress uListing plugin (versions
*-2.0.5
2.0.6
27/07/2021
uListing plugin <= 2.0.5 – Authenticated Insecure Direct Object References (IDOR)
Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions
*-2.0.5
2.0.6
27/07/2021
Listing, Classified Ads & Business Directory – uListing <= 2.0.3 – Unauthenticated SQL Injection
Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions
*-2.0.3
2.0.4
26/07/2021
uListing <= 1.6.6 – Unauthenticated Options Changes via wp_route
The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up to, and including, 1.6.6. This makes it possible for…
[*, 1.7)
1.7
28/01/2021
uListing <= 1.6.6 – Missing Authorization
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6.…
[*, 1.7)
1.7
28/01/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.