Directory Listings WordPress plugin – uListing

ulisting · plugin

Known security vulnerabilities for Directory Listings WordPress plugin – uListing. Find out in seconds which version runs on your site with WP Lens.

25 known vulnerabilities

6 critical · 14 exploitable without logging in · 6 with no official fix seen · latest Jul 23, 2026

Listed on wordpress.org · latest 2.2.0 · last updated Apr 15, 2025 · 1K+ installs

wordpress.org status checked on Oct 5, 2026

Vulnerabilities

CVE-2021-4381unauthenticated→ 1.7
uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route
Critical 9.8
CVE-2021-4370unauthenticated→ 1.7
uListing <= 1.6.6 - Missing Authorization
Critical 9.8
CVE-2021-4343unauthenticated→ 1.7
uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation
Critical 9.8
CVE-2021-36880unauthenticated≤ 2.0.3
WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability
Critical 9.8
CVE-2021-36879unauthenticated≤ 2.0.5
WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability
Critical 9.8
CVE-2025-25150unauthenticated≤ 2.1.6
WordPress uListing plugin <= 2.1.6 - SQL Injection vulnerability
Critical 9.3
CVE-2021-36876unauthenticated · needs a click≤ 2.0.5
WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
High 8.8
CVE-2025-32662login requiredno fix seen
WordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerability
High 8.8
CVE-2025-1657subscriber+no fix seen
Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injecti
High 8.8
CVE-2025-1653subscriber+no fix seen
Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation
High 8.8
CVE-2021-36874login required≤ 2.0.5
WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability
High 8.8
CVE-2025-25151login required≤ 2.1.6
WordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerability
High 8.5
CVE-2025-32122high privilegeno fix seen
WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability
High 7.6
CVE-2021-4346unauthenticated→ 1.7
uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes
High 7.5
CVE-2026-28138high privilegeno fix seen
WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability
High 7.2
CVE-2021-36877unauthenticated · needs a click≤ 2.0.5
WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability
Medium 6.5
CVE-2026-27391subscriber+≤ 2.2.0
WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability
Medium 5.4
CVE-2024-47344unauthenticated≤ 2.1.5
WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability
Medium 5.3
CVE-2021-4357unauthenticated→ 1.7
uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion
Medium 5.3
CVE-2021-4345unauthenticated→ 1.7
uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion
Medium 5.3
CVE-2021-4339unauthenticated→ 1.7
uListing <= 1.6.6 - Unauthenticated Information Disclosure
Medium 5.3
CVE-2026-28078high privilegeno fix seen
WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability
Medium 4.9
CVE-2021-36875high privilege≤ 2.0.5
WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability
Medium 4.8
CVE-2021-36878unauthenticated · needs a click≤ 2.0.5
WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability
Medium 4.3
CVE-2026-27392contributor+≤ 2.2.0
WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability
Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS). The record lists the latest wordpress.org release (2.2.0) as affected.

← Back to directory