172 matches found
EUVD-2026-89669
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-6806 Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stmlat/stmlng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2024-6529
워드프레스 플러그인의 취약점에 대한 PoC Proof of Concept 이 저장소에는 다양한 워드프레스 플러그인에서 발견된 여러 취약점에 대한 PoCProof of Concept 스크립트가 포함되어 있습니다. 이 스크립트는 공격자가 이러한 취약점을 악용하여 악의적인 행동을 수행하는 방법을 보여줍니다. 목차 포함된 취약점 설정 및 사용법 Ultimate Classified Listings 플러그인의 반사형 XSS XSS를 이용한 쿠키 탈취 중요 고려사항 포함된 취약점 1. Ultimate Classified Listings...
CVE-2026-96766
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...
CVE-2026-93897
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...
EUVD-2026-86541
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...
EUVD-2026-86533
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...
CVE-2026-96766: Improper Neutralization of Input During Web Page Generation
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...
EUVD-2026-82494
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...
CVE-2026-16750 Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...
CVE-2026-16750 Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...
CVE-2026-16750: Missing Authorization
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvlajaxdealerloadcars function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to...
CVE-2026-19091: Improper Limitation of a Pathname to a Restricted Directory
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...
CVE-2026-13114: Improper Neutralization of Input During Web Page Generation
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possibl...
CVE-2026-57355
Subscriber Broken Access Control in Classified Listing = 5.4.2 versions...
EUVD-2026-41354
Subscriber Broken Access Control in Classified Listing = 5.4.2 versions...
CVE-2026-12435: Missing Authorization
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-10779 Classified Listing <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)
The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the galleryimageupdateasfeature AJAX handler action:...
