Directory Listings WordPress plugin – uListing

Уязвимости

• CVE-2021-4381без авторизации→ 1.7

  uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route

  Критич. 9.8

• CVE-2021-4370без авторизации→ 1.7

  uListing <= 1.6.6 - Missing Authorization

  Критич. 9.8

• CVE-2021-4343без авторизации→ 1.7

  uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation

  Критич. 9.8

• CVE-2021-36880без авторизации≤ 2.0.3

  WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability

  Критич. 9.8

• CVE-2021-36879без авторизации≤ 2.0.5

  WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability

  Критич. 9.8

• CVE-2025-25150без авторизации≤ 2.1.6

  WordPress uListing plugin <= 2.1.6 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2021-36876без авторизации · нужен клик≤ 2.0.5

  WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

  Высокий 8.8

• CVE-2025-32662нужен входисправления нет

  WordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerability

  Высокий 8.8

• CVE-2025-1657подписчик+исправления нет

  Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injecti

  Высокий 8.8

• CVE-2025-1653подписчик+исправления нет

  Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation

  Высокий 8.8

• CVE-2021-36874нужен вход≤ 2.0.5

  WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability

  Высокий 8.8

• CVE-2025-25151нужен вход≤ 2.1.6

  WordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerability

  Высокий 8.5

• CVE-2025-32122высокие праваисправления нет

  WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

  Высокий 7.6

• CVE-2021-4346без авторизации→ 1.7

  uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes

  Высокий 7.5

• CVE-2026-28138высокие праваисправления нет

  WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability

  Высокий 7.2

• CVE-2021-36877без авторизации · нужен клик≤ 2.0.5

  WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability

  Средний 6.5

• CVE-2026-27391подписчик+≤ 2.2.0

  WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

  Средний 5.4

• CVE-2024-47344без авторизации≤ 2.1.5

  WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability

  Средний 5.3

• CVE-2021-4357без авторизации→ 1.7

  uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion

  Средний 5.3

• CVE-2021-4345без авторизации→ 1.7

  uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion

  Средний 5.3

• CVE-2021-4339без авторизации→ 1.7

  uListing <= 1.6.6 - Unauthenticated Information Disclosure

  Средний 5.3

• CVE-2026-28078высокие праваисправления нет

  WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability

  Средний 4.9

• CVE-2021-36875высокие права≤ 2.0.5

  WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2021-36878без авторизации · нужен клик≤ 2.0.5

  WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

  Средний 4.3

• CVE-2026-27392участник+≤ 2.2.0

  WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

  Средний 4.3