Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: WebCodingPlace Component: Ultimate Classified Listings Clear all filters
TI-2024-12786 CVE-2024-13748 · GHSA-c32g-cc55-4835

Ultimate Classified Listings <= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter

Priority LOW 21

The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including, 1.4 due to insufficient input sanitization and output escap…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00228 Published 2025-02-20 No fix listed CWE-79
TI-2024-06055 CVE-2024-6529 · GHSA-g4q4-8vjq-c7c8

Ultimate Classified Listings < 1.4 - Reflected XSS

Priority MEDIUM 64

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high pr…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00958 Published 2024-08-01 Fixed in 1.4 CWE-79
TI-2024-05456 CVE-2024-5883 · GHSA-gmj8-2ww5-fff3

Ultimate Classified Listings < 1.3 - Reflected XSS

Priority MEDIUM 55

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high pr…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00382 Published 2024-07-29 Fixed in 1.3 CWE-79
TI-2024-05455 CVE-2024-5882 · GHSA-27vp-6288-jjwg

Ultimate Classified Listings < 1.3 - Unauthenticated LFI

Priority HIGH 72

The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PHP files on the server from the listings page

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00762 Published 2024-07-29 Fixed in 1.3 CWE-22