Ultimate Classified Listings Security Vulnerabilities and Issues — Ultimate Classified Listings CVE List

Lucene search

WebcodingplaceUltimate Classified Listings

7 matches found

CVE•added 2024/11/20 12:15 p.m.•44 views

CVE-2024-52448

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebCodingPlace Ultimate Classified Listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through 1.4.

7.5CVSS7.5AI score0.0014EPSS

CVE•added 2024/08/01 6:15 a.m.•41 views

CVE-2024-6529

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

7.1CVSS6.1AI score0.16983EPSS

CVE•added 2025/02/20 10:15 a.m.•38 views

CVE-2024-13748

The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

4.8CVSS4.4AI score0.00034EPSS

CVE•added 2025/02/20 10:15 a.m.•36 views

CVE-2024-13753

The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the update_profile function. This makes it possible for unauthenticated attackers to modify victim's e...

8.8CVSS7.8AI score0.00014EPSS

CVE•added 2024/07/29 6:15 a.m.•35 views

CVE-2024-5882

The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the ucl_page and layout parameters allowing unauthenticated users to access PHP files on the server from the listings page

7.5CVSS6.6AI score0.01875EPSS

CVE•added 2024/07/29 6:15 a.m.•35 views

CVE-2024-5883

The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

4.7CVSS5.8AI score0.0008EPSS

CVE•added 2024/12/02 2:15 p.m.•33 views

CVE-2024-52487

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Ultimate Classified Listings allows Stored XSS.This issue affects Ultimate Classified Listings: from n/a through 1.4.

6.5CVSS6.4AI score0.00044EPSS