CridioStudio

Records27All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

CridioStudio records in CISA KEV

No CridioStudio vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Listingpro 12 records MEDIUM

Records

12 records in Listingpro · all components

TI-2020-18890 CVE-2020-36719 · GHSA-vpf4-7pch-f7ph

ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation

MEDIUM 56

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04304 Published 2023-06-07 Fixed in 2.6.1 CWE-862

TI-2024-26547 CVE-2024-39622 · GHSA-fr7q-6mh8-q5fp

WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability

MEDIUM 48

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00458 Published 2024-08-29 No fix listed CWE-89

TI-2024-26028 CVE-2024-38795 · GHSA-2wj5-m5gf-xp7w

WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability

MEDIUM 48

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro-plugin allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00458 Published 2024-08-29 No fix listed CWE-89

TI-2024-26544 CVE-2024-39619 · GHSA-2g9j-pxq8-pw9c

WordPress ListingPro plugin <= 2.9.4 - Unauthenticated Local File Inclusion vulnerability

MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <=…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00553 Published 2024-08-01 No fix listed CWE-22

TI-2024-26549 CVE-2024-39624 · GHSA-824m-78xw-jp8w

WordPress ListingPro theme <= 2.9.4 - Local File Inclusion vulnerability

MEDIUM 41

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00525 Published 2024-08-01 No fix listed CWE-22

TI-2024-26548 CVE-2024-39623 · GHSA-46v9-776w-chff

WordPress ListingPro theme <= 2.9.4 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro listingpro allows Authentication Bypass.This issue affects ListingPro: from n/a through <= 2.9.4.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00293 Published 2025-01-02 No fix listed CWE-352

TI-2024-26545 CVE-2024-39620 · GHSA-g7m4-8h9g-f86c

WordPress ListingPro plugin <= 2.9.4 - SQL Injection vulnerability

LOW 38

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00441 Published 2024-08-29 No fix listed CWE-89

TI-2024-26546 CVE-2024-39621 · GHSA-2jwr-937v-hx6p

WordPress ListingPro plugin <= 2.9.4 - Local File Inclusion vulnerability

LOW 37

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00521 Published 2024-08-01 No fix listed CWE-22

TI-2020-18894 CVE-2020-36723 · GHSA-r88m-vgvq-wfmf

ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure

LOW 33

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01608 Published 2023-06-07 Fixed in 2.6.1 CWE-200

TI-2019-14082 CVE-2019-19540 · GHSA-68pc-q3p4-jwvh

The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.

LOW 29

The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00934 Published 2019-12-26 No fix listed CWE-79

TI-2019-14084 CVE-2019-19542 · GHSA-x3c6-6f4q-8gvc

The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For…

LOW 26

The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00717 Published 2019-12-26 No fix listed CWE-79

TI-2019-14083 CVE-2019-19541 · GHSA-qvf8-847g-6f46

The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best…

LOW 26

The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00717 Published 2019-12-26 No fix listed CWE-79

Open these records in search →

Critical	4
High	10
Medium	13
Low	0
No CVSS	0