CVE-2024-6529

The Ultimate Classified Listings WordPress plugin (versions before 1.4 ) is vulnerable to Reflected Cross-Site Scripting (XSS) because it fails to sanitize and escape a parameter before outputting it back to the page. An attacker can inject malicious scripts through the search parameter (e.g., ?s...

CVE-2024-5882

The Ultimate Classified Listings WordPress plugin (versions prior to 1.3 ) is vulnerable to an unauthenticated Local File Inclusion (LFI) vulnerability. The root cause is a failure to validate the ucl_page and layout parameters on the listings page, which allows attackers to access internal PHP f...

CVE-2024-5883

The Ultimate Classified Listings WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 1.3 . The root cause is a failure to properly sanitize and escape a parameter before it is outputted back to the page. This vulnerability can be exploited against high-priv...

CVE-2024-13748

CVE-2024-13748 — Ultimate Classified Listings for WordPress has a Stored XSS in the Title parameter on all versions up to 1.4. Exploitation requires administrator-level access and affects multisite or sites with unfiltered_html disabled. Wordfence reports the vulnerability as present and notes a ...

CVE-2024-13753

CVE-2024-13753 — The Ultimate Classified Listings WordPress plugin is vulnerable to Cross-Site Request Forgery in all versions up to 1.4 due to missing or incorrect nonce validation on the update_profile function. This could allow unauthenticated attackers to modify a victim’s email via a forged ...