189 matches found
EUVD-2026-52163
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts,...
CVE-2026-16276
The Classified Listing WordPress plugin (before 5.4.4) does not perform a capability check on an AJAX action that returns aggregated store revenue totals (rtcl_revenue_order_search), allowing users with contributor-level access and above to read daily revenue figures normally restricted to admini...
CVE-2026-16274
CVE-2026-16274 concerns the Classified Listing WordPress plugin, versions before 5.4.4. The issue arises from a missing capability/ownership check on an AJAX action that returns a post’s content. This allows users with contributor-level access and above to read content from any post, page, or cus...
CVE-2026-14183
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order...
CVE-2026-14183
The CVE describes a vulnerability in the Classified Listing WordPress plugin prior to version 5.3.9. The payment-receipt handler does not verify that the targeted order belongs to the requesting user, enabling authenticated users with subscriber-level access to read payment receipt details for ot...
CVE-2026-14183 Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order...
CVE-2026-57344
Unauthenticated Cross Site Scripting XSS in Classified Listing = 5.4.2 versions...
CVE-2026-57355
Subscriber Broken Access Control in Classified Listing = 5.4.2 versions...
CVE-2026-57355 WordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Classified Listing = 5.4.2 versions...
CVE-2026-57355
The WordPress Classified Listing plugin ≤ 5.4.2 has a Broken Access Control vulnerability. Affected software: Classified Listing plugin for WordPress (versions ≤ 5.4.2). Root cause: insufficient access checks. Impact: according to CVSS 3.1 metrics (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with a base...
CVE-2026-57344 WordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Classified Listing = 5.4.2 versions...
CVE-2026-57344
Summary: Unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Classified Listing plugin (versions <= 5.4.2). Affected product: WordPress Classified Listing plugin.Versions:
WordPress Classified Listing plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Classified Listing versions = 5.4.2...
CVE-2026-10779
The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the galleryimageupdateasfeature AJAX handler action:...
EUVD-2026-37978
The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the galleryimageupdateasfeature AJAX handler action:...
CVE-2026-10779
CVE-2026-10779 affects the WordPress Classified Listing plugin (versions
CVE-2026-10779 Classified Listing <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)
The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the galleryimageupdateasfeature AJAX handler action:...
CVE-2026-10779
The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the galleryimageupdateasfeature AJAX handler action:...
PT-2026-50830
Name of the Vulnerable Software and Affected Versions Classified Listing – Classified ads & Business Directory versions prior to 5.4.3 Description The plugin contains a missing authorization flaw in the gallery image update as feature AJAX handler action: rtcl fb gallery image update as feature...
WordPress Classified Listing – AI-Powered Classified ads & Business Directory plugin <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Feature Modification vulnerability discovered by Ben Tamam Ben Tamam in WordPress Plugin Classified Listing versions = 5.4.2...