Skip to content
Noroxi

Directory Listings WordPress plugin – uListing

ulisting · plugin

Known security vulnerabilities for Directory Listings WordPress plugin – uListing. Find out in seconds which version runs on your site with WP Lens.

25 known vulnerabilities

6 critical · latest Jul 23, 2026

Vulnerabilities

  • CVE-2021-4381→ 1.7

    uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route

    Critical 9.8

  • CVE-2021-4370→ 1.7

    uListing <= 1.6.6 - Missing Authorization

    Critical 9.8

  • CVE-2021-4343→ 1.7

    uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation

    Critical 9.8

  • CVE-2021-36880

    WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability

    Critical 9.8

  • CVE-2021-36879

    WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability

    Critical 9.8

  • CVE-2025-25150

    WordPress uListing plugin <= 2.1.6 - SQL Injection vulnerability

    Critical 9.3

  • CVE-2025-32662

    WordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerability

    High 8.8

  • CVE-2025-1657

    Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injecti

    High 8.8

  • CVE-2025-1653

    Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation

    High 8.8

  • CVE-2021-36876

    WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    High 8.8

  • CVE-2021-36874

    WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability

    High 8.8

  • CVE-2025-25151

    WordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerability

    High 8.5

  • CVE-2025-32122

    WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

    High 7.6

  • CVE-2021-4346→ 1.7

    uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes

    High 7.5

  • CVE-2026-28138

    WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability

    High 7.2

  • CVE-2021-36877

    WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability

    Medium 6.5

  • CVE-2026-27391

    WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

    Medium 5.4

  • CVE-2024-47344

    WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

    Medium 5.3

  • CVE-2021-4357→ 1.7

    uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion

    Medium 5.3

  • CVE-2021-4345→ 1.7

    uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion

    Medium 5.3

  • CVE-2021-4339→ 1.7

    uListing <= 1.6.6 - Unauthenticated Information Disclosure

    Medium 5.3

  • CVE-2026-28078

    WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability

    Medium 4.9

  • CVE-2021-36875

    WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2026-27392

    WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2021-36878

    WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

    Medium 4.3

← Back to directory