Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes. id: CVE-2019-17228 info: name: Motors Car Dealer & Classified Ads = 1.4.0 - Unauthenticated settings...

WordPress Classified Listing plugin < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification vulnerability

Subscriber+ Unattached Media Deletion and Modification vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Classified Listing versions 6.1.1...

CVE-2026-107650

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107754

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postimages fileinfo2 = title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output...

EUVD-2026-100910

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107754

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.8.190 . The root cause is insufficient input sanitization and output escaping within the post_images (file_i...

EUVD-2026-100899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postimages fileinfo2 = title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output...

CVE-2026-106646

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...

CVE-2026-106646 Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...

EUVD-2026-100885

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...

CVE-2026-106646

The Classified Listing WordPress plugin (versions before 6.1.1 ) contains a vulnerability where it fails to verify requester ownership or editing permissions for target listings when a gallery request references an unattached media item . This flaw allows any authenticated user with a subscriber-...

CVE-2026-100185

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-100185

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 8.10.2.1 . The root cause is insufficient input sanitization and output escaping within the 'phone' Listing Field ....

CVE-2026-17092 Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-17092

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 8.10.2.1 . The root cause is a failure to properly verify user permissions when performing certain actions. Consequently, an ...

PT-2026-113718

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post images file info2 = title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output...

PT-2026-113716

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post title' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-113612

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

PT-2026-113664

The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library...

CVE-2024-6529

Proof of Concept PoC for Vulnerabilities in WordPress Plugins This repository contains Proof of Concept PoC scripts for various vulnerabilities discovered in different WordPress plugins. These scripts demonstrate how attackers can exploit these vulnerabilities to perform malicious actions. Table ...