Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Release: stylemix Directory Listings WordPress plugin – uListing 1.7 Clear all filters
TI-2021-03238 CVE-2021-4381 · GHSA-g6pv-vrjh-4g5j

uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route

Priority MEDIUM 52

The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01388 Published 2023-06-07 Fixed in 1.7 CWE-862
TI-2021-03227 CVE-2021-4370 · GHSA-mwfr-f8cq-76v9

uListing <= 1.6.6 - Missing Authorization

Priority MEDIUM 52

The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01388 Published 2023-06-07 Fixed in 1.7 CWE-862
TI-2021-03214 CVE-2021-4357 · GHSA-pf88-x499-h8w3

uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion

Priority MEDIUM 47

The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::save_role_api function in versions up to, and including, 1.…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0101 Published 2023-06-07 Fixed in 1.7 CWE-862
TI-2021-03203 CVE-2021-4346 · GHSA-f7xc-mx7q-rc22

uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes

Priority MEDIUM 51

The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01239 Published 2023-06-07 Fixed in 1.7 CWE-862
TI-2021-03200 CVE-2021-4343 · GHSA-h5x9-8r4g-vvqc

uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation

Priority MEDIUM 52

The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01388 Published 2023-06-07 Fixed in 1.7 CWE-862
TI-2021-03199 CVE-2021-4341 · GHSA-3mq7-vphm-cjch

uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX

Priority MEDIUM 51

The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stm_update_email_data AJAX action in versio…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01125 Published 2023-06-07 Fixed in 1.7 CWE-862
TI-2021-03198 CVE-2021-4340 · GHSA-hv43-fjj6-p6qh

uListing <= 1.6.6 - Unauthenticated SQL Injection

Priority MEDIUM 51

The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1.6.6 due to insufficient escaping on the user supplied parameter and lack of suff…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01175 Published 2023-06-07 Fixed in 1.7 CWE-89
TI-2021-03197 CVE-2021-4339 · GHSA-99h6-wmg5-777v

uListing <= 1.6.6 - Unauthenticated Information Disclosure

Priority MEDIUM 41

The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00946 Published 2023-06-07 Fixed in 1.7 CWE-862