uListing < 1.7 - Unauthenticated WordPress Options Change

The AJAX action stmupdateemaildata accessible to both authenticated and unauthenticated users, as well as the /1/api/ulisting-builder/listing-single-layout/new-layout REST route did not perform capability and CSRF checks, allowing unauthenticated users to change any WordPress option...

uListing < 1.7 - Unauthenticated Information Disclosure

The /1/api/ulisting-user/search REST route did not perform capability and CSRF checks, allowing unauthenticated users to get the list of all users and their email address...

uListing < 1.7 - Unauthenticated SQL Injections

The /1/api/ulisting-page-statistics/listing REST route did not sanitise or escape the listingid and userid GET parameters before using them in a SQL statement, leading to an SQL Injection issue. The plugin also did not sanitise and escape the HTTPCLIENTIP and HTTPXFORWARDEDFOR which are then used...