cridio records
12 published records for vendor cridio.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 75%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')3
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-862 Missing Authorization1
The weakness classes this vendor ships most often: where to look.
CWEAll records
12 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2020-36719Proof of concept | ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivationcridio · listingpro · CWE-862 | Critical9.8 | — | 4.3% | Jun 6, 2023 |
39Monitor | CVE-2024-39619No exploit | WordPress ListingPro plugin <= 2.9.4 - Unauthenticated Local File Inclusion vulnerabilitycridio · listingpro · CWE-22 | Critical9.8 | — | 0.5% | Aug 1, 2024 |
39Monitor | CVE-2024-38795No exploit | WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerabilitycridio · listingpro · CWE-89 | Critical9.8 | — | 0.4% | Aug 29, 2024 |
39Monitor | CVE-2024-39622No exploit | WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerabilitycridio · listingpro · CWE-89 | Critical9.8 | — | 0.4% | Aug 29, 2024 |
35Monitor | CVE-2024-39624No exploit | WordPress ListingPro theme <= 2.9.4 - Local File Inclusion vulnerabilitycridio · listingpro · CWE-22 | High8.8 | — | 0.5% | Aug 1, 2024 |
35Monitor | CVE-2024-39620No exploit | WordPress ListingPro plugin <= 2.9.4 - SQL Injection vulnerabilitycridio · listingpro · CWE-89 | High8.8 | — | 0.4% | Aug 29, 2024 |
35Monitor | CVE-2024-39623No exploit | WordPress ListingPro theme <= 2.9.4 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerabilitycridio · listingpro · CWE-352 | High8.8 | — | 0.2% | Jan 2, 2025 |
28Monitor | CVE-2024-39621No exploit | WordPress ListingPro plugin <= 2.9.4 - Local File Inclusion vulnerabilitycridio · listingpro · CWE-22 | High7.2 | — | 0.5% | Aug 1, 2024 |
24Monitor | CVE-2019-19540No exploit | The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.cridio · listingpro · CWE-79 | Medium6.1 | — | 0.9% | Dec 26, 2019 |
21Monitor | CVE-2020-36723Proof of concept | ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosurecridio · listingpro · CWE-200 | Medium5.3 | — | 1.6% | Jun 6, 2023 |
21Monitor | CVE-2019-19541No exploit | The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.cridio · listingpro · CWE-79 | Medium5.4 | — | 0.7% | Dec 26, 2019 |
21Monitor | CVE-2019-19542No exploit | The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.cridio · listingpro · CWE-79 | Medium5.4 | — | 0.7% | Dec 26, 2019 |
- CVE-2020-3671940Plan
ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation
CriticalCVSS 9.8Proof of conceptEPSS 4%cridio · listingproJun 6, 2023
- CVE-2024-3961939Monitor
WordPress ListingPro plugin <= 2.9.4 - Unauthenticated Local File Inclusion vulnerability
CriticalCVSS 9.8No exploitEPSS 0%cridio · listingproAug 1, 2024
- CVE-2024-3879539Monitor
WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%cridio · listingproAug 29, 2024
- CVE-2024-3962239Monitor
WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%cridio · listingproAug 29, 2024
- CVE-2024-3962435Monitor
WordPress ListingPro theme <= 2.9.4 - Local File Inclusion vulnerability
HighCVSS 8.8No exploitEPSS 0%cridio · listingproAug 1, 2024
- CVE-2024-3962035Monitor
WordPress ListingPro plugin <= 2.9.4 - SQL Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%cridio · listingproAug 29, 2024
- CVE-2024-3962335Monitor
WordPress ListingPro theme <= 2.9.4 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability
HighCVSS 8.8No exploitEPSS 0%cridio · listingproJan 2, 2025
- CVE-2024-3962128Monitor
WordPress ListingPro plugin <= 2.9.4 - Local File Inclusion vulnerability
HighCVSS 7.2No exploitEPSS 0%cridio · listingproAug 1, 2024
- CVE-2019-1954024Monitor
The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.
MediumCVSS 6.1No exploitEPSS 0%cridio · listingproDec 26, 2019
- CVE-2020-3672321Monitor
ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure
MediumCVSS 5.3Proof of conceptEPSS 1%cridio · listingproJun 6, 2023
- CVE-2019-1954121Monitor
The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.
MediumCVSS 5.4No exploitEPSS 0%cridio · listingproDec 26, 2019
- CVE-2019-1954221Monitor
The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.
MediumCVSS 5.4No exploitEPSS 0%cridio · listingproDec 26, 2019