Plugin icon

Directory Listings WordPress plugin – uListing

ulisting

Vulnerabilities:

24

Last Updated:

April 15, 2025

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-02-26
Title
Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Editor+) Arbitrary File Download
Fixed in
No known fix
CVSS
4.9 (medium)
Published
2025-04-15
Title
uListing <= 2.2.0 - Authenticated (Subscriber+) PHP Object Injection
Fixed in
No known fix
CVSS
8.8 (high)
Published
2025-04-04
Title
uListing <= 2.2.0 - Admin+ SQL Injection
Fixed in
No known fix
CVSS
4.1 (medium)
Published
2025-03-14
Title
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection
Fixed in
No known fix
CVSS
8.8 (high)
Published
2025-03-14
Title
uListing <= 2.1.7 - Subscriber+ Privilege Escalation
Fixed in
No known fix
CVSS
8.8 (high)
Published
2025-02-03
Title
uListing < 2.1.7 - Unauthenticated SQL Injection
Fixed in
Fixed in 2.1.7
CVSS
7.5 (high)
Published
2025-02-03
Title
uListing < 2.1.7 - Authenticated (Contributor+) SQL Injection
Fixed in
Fixed in 2.1.7
CVSS
6.5 (medium)
Published
2024-09-27
Title
uListing < 2.1.6 - Unauthenticated Information Exposure
Fixed in
Fixed in 2.1.6
CVSS
5.3 (medium)
Published
2021-09-06
Title
uListing < 2.0.9 - Arbitrary Blog Option Update via CSRF
Fixed in
Fixed in 2.0.9
CVSS
8.8 (high)
Published
2021-07-27
Title
uListing < 2.0.6 - Modify User Roles via CSRF
Fixed in
Fixed in 2.0.6
CVSS
5.4 (medium)
Published
2021-07-27
Title
uListing < 2.0.6 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 2.0.6
CVSS
4.8 (medium)
Published
2021-07-27
Title
uListing < 2.0.6 - Authenticated IDOR
Fixed in
Fixed in 2.0.6
CVSS
5.4 (medium)
Published
2021-07-27
Title
uListing < 2.0.6 - Multiple CSRF
Fixed in
Fixed in 2.0.6
CVSS
4.3 (medium)
Published
2021-07-27
Title
uListing < 2.0.6 - Settings Update via CSRF
Fixed in
Fixed in 2.0.6
CVSS
4.3 (medium)
Published
2021-07-27
Title
uListing < 2.0.6 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.0.6
CVSS
6.1 (medium)
Published
2021-07-26
Title
uListing < 2.0.4 - Unauthenticated SQL Injection
Fixed in
Fixed in 2.0.4
CVSS
7.5 (high)
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion
Fixed in
Fixed in 1.7
CVSS
5.3 (medium)
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated Arbitrary Post/Page Deletion
Fixed in
Fixed in 1.7
CVSS
8.2 (high)
Published
2021-01-28
Title
uListing < 1.7 - Missing Access Controls
Fixed in
Fixed in 1.7
CVSS
9.8 (critical)
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated Arbitrary Account Change
Fixed in
Fixed in 1.7
CVSS
7.5 (high)
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated Information Disclosure
Fixed in
Fixed in 1.7
CVSS
7.5 (high)
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated SQL Injections
Fixed in
Fixed in 1.7
CVSS
10.0 (critical)
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated Arbitrary Account Creation
Fixed in
Fixed in 1.7
CVSS
9.8 (critical)
Published
2021-01-28
Title
uListing < 1.7 - Unauthenticated WordPress Options Change
Fixed in
Fixed in 1.7
CVSS
9.8 (critical)