CVE-2024-6529

The Ultimate Classified Listings WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 1.4 . The root cause is the failure to properly sanitise and escape a parameter before outputting it back to the page. This flaw could be exploited to target high-privilege...

CVE-2024-5883

The Ultimate Classified Listings WordPress plugin in versions prior to 1.3 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. This flaw could be exploited against high-privile...

CVE-2024-5882

The Ultimate Classified Listings WordPress plugin, in versions prior to 1.3 , contains an unauthenticated Local File Inclusion (LFI) vulnerability. The root cause is a lack of validation for the ucl_page and layout parameters on the listings page, which allows unauthenticated attackers to access ...

CVE-2024-13748

CVE-2024-13748 — Ultimate Classified Listings for WordPress has a Stored XSS in the Title parameter on all versions up to 1.4. Exploitation requires administrator-level access and affects multisite or sites with unfiltered_html disabled. Wordfence reports the vulnerability as present and notes a ...